Security context

Highlights

Auth Bypass: 26 prior fixes. Scrutinize any change in this area.

src/background/controller/provider/controller.ts: most-fixed (9 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Multiple critical bypasses in the core RPC dispatch: a typo in the permission check method name disabled all origin authorization, and several signing methods (ethSignTypedData, personalSign, ethSendTransaction) failed to validate that the requested 'from' address and chainId matched the active account, allowing untrusted DApps to trigger signatures or transactions.

Auth Bypass: Transaction signing flow had multiple authorization gaps: approval resolution was not bound to a specific approvalId, security check results could be overridden by a 'safe' heuristic, and watch-only accounts could sign. These allow an attacker to bypass user consent or execute transactions from unauthorized accounts.

Signature Bypass: Typed data normalization had multiple bypasses: address values were not strictly hex-validated, decimal addresses were not normalized, and undeclared fields were not filtered, enabling attackers to craft messages that bypass security engine inspection or spoof the displayed content.