clawbot ad9162d057 security: decrypt and sign dApp approvals in the popup (closes #157) ...

The password no longer crosses the extension messaging boundary: the popup
decrypts and signs, and sends only the raw signed transaction or the signature.
The background re-derives the signer from the artifact and checks it against
the approval it holds before broadcasting, so it is not a blind relay.

2026-08-10 15:59:30 +02:00

12 KiB

Raw Blame History

View Raw