useWalletAction re-checks the network before a money action but never re-checks Freighter's active account, so funds can be sent to an address the user switched away from

Open
  • Is something wrong?
#840 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
authentication, payments

Research direction

Read src/hooks/useWalletAction.ts and the wallet state and helper logic in src/context/WalletContext.tsx and src/lib/wallet.ts. Trace how runWithWallet checks the address before dispatching an action, then inspect useWalletAction.test.tsx for existing mismatch coverage. Done means an account switch after mount is detected and the money action is blocked, with the relevant test passing.

Written by the indexing model from the issue text.

Description

bug security

Location

src/hooks/useWalletAction.ts:25-52 (runWithWallet), against WalletContext's addressMismatch (src/context/WalletContext.tsx:155-183) and recheckNetworkMismatch (:144-148).

Problem

The hook treats its two mismatch signals asymmetrically:

if (addressMismatch) return { ok: false, error: ADDRESS_MISMATCH_ERROR };
if (networkMismatch && (await recheckNetworkMismatch())) {
  return { ok: false, error: NETWORK_MISMATCH_ERROR };
}

The network flag is explicitly re-derived at action time, with a comment explaining exactly why a mount-time snapshot is not trustworthy ("the user can switch networks inside the extension at any time afterwards"). The address flag gets no such treatment — it is read as a plain boolean.

And addressMismatch is only ever written in one place: the deferred mount effect, comparing the localStorage value against getActiveFreighterAddress() (WalletContext.tsx:166-171). Everything else only ever clears it (connect/adoptAndLink, disconnect, the cross-tab handler, the profile-sync effect). Nothing re-reads Freighter after mount.

So the argument that justified recheckNetworkMismatch applies verbatim to the address, in the direction that matters: a user who switches accounts inside the Freighter extension after page load leaves addressMismatch === false and address pointing at the account they switched away from. The guard passes, and because address is non-null, runWithWallet never calls connect() — which is the only code path that would have asked Freighter anything:

const walletAddress = address ?? (await connect());
...
await action(walletAddress);

Why it matters

walletAddress is passed straight into the money calls as funderAddress (bounty fund, milestone fund, pool deposit) and backs the refund/payout destination. The address the user believes is active in their extension and the address MergeFi submits are different, with nothing on screen saying so and no Freighter prompt in the loop to reveal it. The stale address can be an account the user no longer holds keys for in this browser profile, or (with a shared/hardware setup) one belonging to someone else.

The passive read needed to prevent this already exists and is already used on mount: getActiveFreighterAddress() in src/lib/wallet.ts:68-79 prompts for nothing and returns null if the extension is absent or not allowed.

Reproduction

  1. Sign in, connect Freighter, link the wallet. Leave the bounty or milestone page open.
  2. Open the Freighter extension and switch to a different account. Do not reload MergeFi.
  3. Click "Fund this bounty" (or any milestone/pool funding action).
  4. The action is submitted with the address from step 1. No mismatch warning, no reconnect prompt. addressMismatch is still false because nothing re-read the extension after mount.

Suggested fix

Mirror the network treatment: add a recheckAddressMismatch() to WalletContext and call it from runWithWallet before dispatching the action.

// WalletContext
const recheckAddressMismatch = useCallback(async () => {
  const live = await getActiveFreighterAddress();
  if (!live) return false;                 // extension unreachable: not a mismatch we can prove
  const mismatched = !!address && live !== address;
  setAddressMismatch(mismatched);
  return mismatched;
}, [address]);

// useWalletAction
if (addressMismatch || (await recheckAddressMismatch())) {
  return { ok: false, error: ADDRESS_MISMATCH_ERROR };
}

Note that unlike the network case the check must run even when the cached flag is false — a stale false is the dangerous direction here, since it is what lets the action through. Freighter does not expose an account-change event, so an action-time read is the only reliable point. A test in useWalletAction.test.tsx covering "active account changed after mount -> action blocked" would lock this in; the suite currently only exercises the mount-time flag.

Dominant language
TypeScript
Stars
1
Forks
94
Avg merge
1h 2m
Merged PRs (30d)
25

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from MergeFi/frontend

All issues in MergeFi/frontend

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.