Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mytonwallet-org/mytonwallet

              master @ 36acfff
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Data Integrity / Wallet Loss: 1 prior fix. Scrutinize any change in this area.

src/api/common/addresses.ts: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Data Integrity / Wallet Loss: A cleanup routine could erase all legacy mnemonics when given an empty or missing account list, permanently destroying wallet recovery data. The fix inverted the logic to require an explicit list of migrated accounts, but any future refactor of this or similar cleanup paths could reintroduce the destructive default.

Phishing: The scam-link filter could be bypassed using confusable Unicode homoglyphs, allowing phishing links to pass. The fix added canonicalization before regex matching, but other text-processing paths that check URLs or user-supplied strings may still lack this normalization.