Skip to content

fix(frontend): reject mixed Solana WC reviews#13158

Draft
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/high-severity-issue-resolution-4d30
Draft

fix(frontend): reject mixed Solana WC reviews#13158
cursor[bot] wants to merge 1 commit into
mainfrom
cursor/high-severity-issue-resolution-4d30

Conversation

@cursor

@cursor cursor Bot commented Jun 21, 2026

Copy link
Copy Markdown
Contributor

Motivation

A malicious Solana WalletConnect request could include a decoded, benign-looking transfer plus an additional unreviewed instruction. The review summary displayed only the decoded movement, while approval still signed the full transaction, making hidden fund-moving effects possible.

Changes

  • Treat Solana WalletConnect transaction messages that mix reviewed fund movement with unreviewed instructions as ambiguous.
  • Keep wholly unreviewed transactions on the existing warning path instead of inventing an incomplete summary.
  • Add regression coverage for reviewed-then-unreviewed and unreviewed-then-reviewed instruction ordering.

Tests

  • npm run test -- src/frontend/src/tests/sol/utils/sol-transactions.utils.spec.ts src/frontend/src/tests/sol/services/wallet-connect.services.spec.ts
  • npm run format
  • npm run lint -- --max-warnings 0
  • npm run check
  • npm run test
  • npm run check:tests
  • npm run lint:lockfile
Open in Web View Automation 

Co-authored-by: Antonio Ventilii <AntonioVentilii@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant