useWalletAction re-checks the network before a money action but never re-checks Freighter's active account, so funds can be sent to an address the user switched away from

Aperta
  • Qualcosa non va?
#840 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
72/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
authentication, payments

Direzione di ricerca

Read src/hooks/useWalletAction.ts and the wallet state and helper logic in src/context/WalletContext.tsx and src/lib/wallet.ts. Trace how runWithWallet checks the address before dispatching an action, then inspect useWalletAction.test.tsx for existing mismatch coverage. Done means an account switch after mount is detected and the money action is blocked, with the relevant test passing.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug security

Location

src/hooks/useWalletAction.ts:25-52 (runWithWallet), against WalletContext's addressMismatch (src/context/WalletContext.tsx:155-183) and recheckNetworkMismatch (:144-148).

Problem

The hook treats its two mismatch signals asymmetrically:

if (addressMismatch) return { ok: false, error: ADDRESS_MISMATCH_ERROR };
if (networkMismatch && (await recheckNetworkMismatch())) {
  return { ok: false, error: NETWORK_MISMATCH_ERROR };
}

The network flag is explicitly re-derived at action time, with a comment explaining exactly why a mount-time snapshot is not trustworthy ("the user can switch networks inside the extension at any time afterwards"). The address flag gets no such treatment — it is read as a plain boolean.

And addressMismatch is only ever written in one place: the deferred mount effect, comparing the localStorage value against getActiveFreighterAddress() (WalletContext.tsx:166-171). Everything else only ever clears it (connect/adoptAndLink, disconnect, the cross-tab handler, the profile-sync effect). Nothing re-reads Freighter after mount.

So the argument that justified recheckNetworkMismatch applies verbatim to the address, in the direction that matters: a user who switches accounts inside the Freighter extension after page load leaves addressMismatch === false and address pointing at the account they switched away from. The guard passes, and because address is non-null, runWithWallet never calls connect() — which is the only code path that would have asked Freighter anything:

const walletAddress = address ?? (await connect());
...
await action(walletAddress);

Why it matters

walletAddress is passed straight into the money calls as funderAddress (bounty fund, milestone fund, pool deposit) and backs the refund/payout destination. The address the user believes is active in their extension and the address MergeFi submits are different, with nothing on screen saying so and no Freighter prompt in the loop to reveal it. The stale address can be an account the user no longer holds keys for in this browser profile, or (with a shared/hardware setup) one belonging to someone else.

The passive read needed to prevent this already exists and is already used on mount: getActiveFreighterAddress() in src/lib/wallet.ts:68-79 prompts for nothing and returns null if the extension is absent or not allowed.

Reproduction

  1. Sign in, connect Freighter, link the wallet. Leave the bounty or milestone page open.
  2. Open the Freighter extension and switch to a different account. Do not reload MergeFi.
  3. Click "Fund this bounty" (or any milestone/pool funding action).
  4. The action is submitted with the address from step 1. No mismatch warning, no reconnect prompt. addressMismatch is still false because nothing re-read the extension after mount.

Suggested fix

Mirror the network treatment: add a recheckAddressMismatch() to WalletContext and call it from runWithWallet before dispatching the action.

// WalletContext
const recheckAddressMismatch = useCallback(async () => {
  const live = await getActiveFreighterAddress();
  if (!live) return false;                 // extension unreachable: not a mismatch we can prove
  const mismatched = !!address && live !== address;
  setAddressMismatch(mismatched);
  return mismatched;
}, [address]);

// useWalletAction
if (addressMismatch || (await recheckAddressMismatch())) {
  return { ok: false, error: ADDRESS_MISMATCH_ERROR };
}

Note that unlike the network case the check must run even when the cached flag is false — a stale false is the dangerous direction here, since it is what lets the action through. Freighter does not expose an account-change event, so an action-time read is the only reliable point. A test in useWalletAction.test.tsx covering "active account changed after mount -> action blocked" would lock this in; the suite currently only exercises the mount-time flag.

Lingua principale
TypeScript
Stelle
1
Fork
94
Merge medio
1h 2m
PR unite (30g)
25

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di MergeFi/frontend

Tutte le issue di MergeFi/frontend

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.