sneak
ab3b452924
All checks were successful
check / check (push) Successful in 28s
The dApp transaction and signature approval paths sent the user's plaintext password to the background over runtime.sendMessage and decrypted there. Both now decrypt in the popup, where the password is typed, and put only the signed artifact on the wire: the raw signed transaction, or the signature. Neither the password, the recovery phrase, the xprv nor the private key crosses the messaging boundary any more. This matches what the popup-side eth_sendTransaction path in confirmTx.js already did. The popup runs the same sequence ethers' own sendTransaction() runs internally (populateTransaction, then signTransaction), so nonce, gas, fee and chain id population are unchanged. The background keeps broadcast and approval resolution, and when the popup cannot produce an artifact it reports the error over the same message so the requesting page still gets a failure rather than hanging. Moving the secret out of the background must not turn the background into a blind relay, so it re-derives the signer from the artifact and checks it against the approval it is holding before acting: shared/approvalVerify.js asserts that a raw transaction is the approved transaction signed by the approved address, and that a signature covers the approved payload and recovers to the approved address. A wrong password is now caught in the popup before anything is sent, so it fails with an inline full-sentence error and leaves the pending approval alive to retry; previously it reached the background and destroyed the approval. Rejection still resolves with EIP-1193 code 4001, and approvals still survive popup close and reopen. Removes the four standing TODO(security) markers, now that the flaw is gone.
61 lines
2.7 KiB
Markdown
61 lines
2.7 KiB
Markdown
# Workflow
|
|
|
|
- branch (from `main`)
|
|
- do the work in Next Step
|
|
- move Next Step to the top of Completed Steps
|
|
- move the top item of Future Steps into Next Step
|
|
- commit (`TODO.md` changes in the same commit as the work)
|
|
- merge to `main` if the branch is not protected, otherwise open a PR
|
|
- push
|
|
|
|
# Status
|
|
|
|
pre-1.0. Tagged v0.1.0 on 2026-02-27. Active development on branch
|
|
feat/issue-144-settings-about (another agent working as of 2026-07-06). Full
|
|
policy file set present; make check on main not verified.
|
|
|
|
# Next Step
|
|
|
|
Land feat/issue-144-settings-about: finish the settings About well (build info,
|
|
app name and repo link, release date, version click easter egg, git info derived
|
|
inside Docker), resolve the untracked scripts/ directory (commit or gitignore),
|
|
get review, merge to main.
|
|
|
|
# Completed Steps
|
|
|
|
- 2026-08-09: dApp approval signing moved into the popup — the password no
|
|
longer crosses the extension messaging boundary; the background broadcasts and
|
|
resolves approvals only, and verifies the signed artifact against the approval
|
|
it holds (#157).
|
|
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
|
shims, README Entrypoints section
|
|
- 2026-03-01: About well in settings with build info and easter egg (in flight
|
|
on feature branch); USD display suppressed on testnets (#142); estimated USD
|
|
for ETH in approve-tx view (#141).
|
|
- Sepolia testnet support (#137); etherscan links go to token-specific URLs
|
|
(#136).
|
|
- Transaction detail improvements: Type field and on-chain details (#130),
|
|
txid-first reordering (#133), swap display corrections (#128), expanded
|
|
confirm-tx warnings (#118).
|
|
- Dark mode theme setting (Light/Dark/System) with contrast fixes (#126);
|
|
timestamps include timezone offset (#120); layout shift audit, reserved space
|
|
for error messages (#124).
|
|
- Copy-flash visual feedback with timing tune (#113, #121); cross-wallet-type
|
|
duplicate detection (#115).
|
|
- 2026-02-27: v0.1.0 tagged.
|
|
- 2026-02-24: Initial scaffolding: popup UI, BIP-39 wallet creation via
|
|
ethers.js, wallet persistence, real ETH balances over RPC, ENS forward and
|
|
reverse resolution.
|
|
|
|
# Future Steps
|
|
|
|
- Verify main passes make check after the feature branch merges (not verified
|
|
2026-07-06 because an agent was active in the tree); fix anything red. main
|
|
must always be green.
|
|
- Prune stale branches: dozens of merged local and remote feature branches
|
|
remain (fix/_, feature/_, tx-\*); delete merged ones locally and on origin.
|
|
- Continue the issue backlog toward a feature-complete wallet, then cut further
|
|
tags as milestones land.
|
|
- Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
|
|
input validation) before any 1.0rc tag.
|