Feat/cosmos enigma utils OK-50764 OK-50786 OK-50962 by ByteZhang1024 · Pull Request #10456 · OneKeyHQ/app-monorepo

ByteZhang1024 · 2026-03-04T01:46:12Z

OneKeyHQ/cross-inpage-provider#448
OneKeyHQ/cross-inpage-provider#449
OneKeyHQ/cross-inpage-provider#450

revan-zhang · 2026-03-04T01:47:13Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…etNetworkEncryption

devin-ai-integration

Devin Review found 2 new potential issues.

View 7 additional findings in Devin Review.

packages/kit-bg/src/providers/ProviderApiCosmos.ts

devin-ai-integration · 2026-03-05T05:32:49Z

packages/kit-bg/src/providers/ProviderApiCosmos.ts

+  @providerApiMethod()
+  public async getEnigmaPubKey(
+    request: IJsBridgeMessagePayload,
+    params: { chainId: string },
+  ): Promise<string> {
+    const utils = await this._getOrCreateEnigmaUtils(request, params.chainId);
+    const pubkey = await utils.getPubkey();
+    return bytesToHex(pubkey);
+  }


🔴 Missing @permissionRequired() decorator on Enigma provider methods breaks security pattern

All existing Cosmos provider methods that perform sensitive cryptographic operations (signAmino, signDirect, sendTx, signArbitrary, verifyArbitrary) are decorated with @permissionRequired() to ensure the dApp has an approved connection before proceeding. The four new Enigma methods (getEnigmaPubKey, enigmaEncrypt, enigmaDecrypt, enigmaGetTxEncryptionKey) perform cryptographic operations using the user's private key-derived seed but lack this decorator. While _getOrCreateEnigmaUtils internally calls _getAccount → getAccountsInfo which may fail for unconnected dApps, the missing decorator breaks the defense-in-depth pattern established throughout the codebase. The CLAUDE.md rule states: "Crypto operations MUST follow established patterns" and "Transaction verification and risk detection MUST NOT be bypassed".

Prompt for agents

Add the @permissionRequired() decorator to all four Enigma provider methods in packages/kit-bg/src/providers/ProviderApiCosmos.ts to match the existing pattern used by signAmino, signDirect, sendTx, signArbitrary, and verifyArbitrary. Specifically, add @permissionRequired() before @providerApiMethod() on the following methods: 1. getEnigmaPubKey (line 773) 2. enigmaEncrypt (line 783) 3. enigmaDecrypt (line 793) 4. enigmaGetTxEncryptionKey (line 806)

Was this helpful? React with 👍 or 👎 to provide feedback.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbf22ef6b2

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-05T05:36:45Z

packages/kit-bg/src/providers/ProviderApiCosmos.ts

+    if (!password) {
+      const result = (await this.backgroundApi.serviceDApp.openModal({
+        request,
+        screens: [
+          EModalRoutes.DAppConnectionModal,


Fail fast on unsupported wallets before password prompt

_getOrCreateEnigmaUtils asks for a password before checking whether the current keyring can derive an Enigma seed, but VaultCosmos.getEnigmaSeed throws for unsupported wallet types (e.g., hardware/watching). In that scenario, users are forced through an unlock modal and then still get a hard failure, which is a dead-end flow for those wallets; the support check should happen before opening the unlock modal.

Useful? React with 👍 / 👎.

socket-security · 2026-03-05T06:02:16Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality
	@babel/plugin-proposal-class-properties@7.18.6
	@babel/plugin-proposal-class-static-block@7.21.0
	@babel/plugin-proposal-nullish-coalescing-operator@7.18.6
	@babel/plugin-proposal-private-property-in-object@7.21.11
	@aptos-labs/ts-sdk@1.39.0
	@babel/plugin-transform-numeric-separator@7.25.9
	@expo/plist@0.1.3
	@types/node-fetch@2.6.9
	@bottom-tabs/react-navigation@1.1.0
	@aptos-labs/siwa@0.4.0
	@babel/preset-typescript@7.27.1
	esbuild@0.27.2
	@babel/plugin-transform-optional-chaining@7.27.1 ⏵ 7.25.9	⁺¹	⁺¹
	@formatjs/intl-pluralrules@4.3.3
	expo-keep-awake@14.1.4
	@formatjs/intl-locale@2.4.47
	@formatjs/intl-getcanonicallocales@1.9.2
	@babel/preset-env@7.28.6
	@glif/filecoin-rpc-client@3.0.2
	@benfen/bfc.js@0.2.7
	@alephium/web3@1.5.2
	@babel/core@7.27.1
	@glif/filecoin-message@2.0.44
	@electron/remote@2.1.1
	@cityofzion/neon-core@5.7.0
	@ckb-lumos/ckb-indexer@0.23.0
	@emurgo/cardano-message-signing-nodejs@1.0.1
	@cowprotocol/contracts@1.7.0
	@ckb-lumos/common-scripts@0.23.0
	@electron/notarize@2.3.2
	@aivenio/tsc-output-parser@2.1.1
	@glif/filecoin-address@2.0.43
	@conflux-dev/conflux-address-js@1.3.16
See 8 more rows in the dashboard

View full report

socket-security · 2026-03-05T06:02:18Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) CVE: GHSA-vjh7-7g9h-fjfh Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) (CRITICAL) Affected versions: < 6.6.1 Patched version: 6.6.1 From: `?` → `npm/elliptic@6.5.4` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/elliptic@6.5.4`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@emurgo/cardano-message-signing-asmjs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/@emurgo/cardano-message-signing-asmjs@1.0.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emurgo/cardano-message-signing-asmjs@1.0.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

devin-ai-integration

Devin Review found 1 new potential issue.

View 9 additional findings in Devin Review.

devin-ai-integration · 2026-03-05T06:06:38Z

packages/kit-bg/src/vaults/impls/cosmos/sdkCosmos/SecretNetworkEncryption.ts

+      new PolyfillCryptoProvider(),
+    );
+    const plaintext = new TextEncoder().encode(
+      contractCodeHash + JSON.stringify(msg),


🟡 JSON.stringify() used for cryptographic encryption plaintext, violating CLAUDE.md rule

CLAUDE.md explicitly states: "NEVER use JSON.stringify() for cryptographic operations → ALWAYS use stringUtils.stableStringify() for deterministic serialization". At SecretNetworkEncryption.ts:84, JSON.stringify(msg) is used to serialize the message object before AES-SIV encryption, which is a cryptographic operation. While the security impact is minimal (this is encryption plaintext, not a hash/signature input), and JSON.stringify matches the secret.js reference implementation for protocol compatibility, it is an explicit violation of the repository's mandatory rules.

Note on protocol compatibility

The Secret Network protocol and secret.js reference implementation use standard JSON.stringify. Switching to stableStringify could change key ordering and break compatibility with Secret Network contracts. If this is intentional for protocol compatibility, it should be documented with a comment explaining the exception.

Suggested change

contractCodeHash + JSON.stringify(msg),

// NOTE: Using JSON.stringify (not stableStringify) intentionally to match

// the Secret Network / secret.js wire format for contract message encoding.

contractCodeHash + JSON.stringify(msg),

Was this helpful? React with 👍 or 👎 to provide feedback.

* feat: support cosmos enigma utils * feat: update CosmosEnigmaUnlockModal * feat: support unisat asset api * chore: update onekey inprovider version * fix: add type declarations for miscreant to fix tsgo build error * fix: resolve lint errors in miscreant types, ProviderApiBtc, and SecretNetworkEncryption --------- Co-authored-by: Leon <lixiao.dev@gmail.com>

ByteZhang1024 force-pushed the feat/cosmosEnigmaUtils branch from ce2cf6b to 2f869e2 Compare March 4, 2026 01:57

ByteZhang1024 changed the title ~~Feat/cosmos enigma utils OK-50764 OK-50786~~ Feat/cosmos enigma utils OK-50764 OK-50786 OK-50962 Mar 5, 2026

ByteZhang1024 added 4 commits March 5, 2026 11:38

feat: support cosmos enigma utils

06b84eb

feat: update CosmosEnigmaUnlockModal

630f344

feat: support unisat asset api

428d914

chore: update onekey inprovider version

7649397

ByteZhang1024 force-pushed the feat/cosmosEnigmaUtils branch from 2f869e2 to 7649397 Compare March 5, 2026 03:50

fix: add type declarations for miscreant to fix tsgo build error

700a5c5

ByteZhang1024 marked this pull request as ready for review March 5, 2026 04:52

ByteZhang1024 requested review from ezailWang, huhuanming, originalix, revan-zhang and sidmorizon as code owners March 5, 2026 04:52

This comment was marked as resolved.

Sign in to view

ByteZhang1024 enabled auto-merge (squash) March 5, 2026 04:56

This comment was marked as resolved.

Sign in to view

fix: resolve lint errors in miscreant types, ProviderApiBtc, and Secr…

1f0691f

…etNetworkEncryption

ByteZhang1024 force-pushed the feat/cosmosEnigmaUtils branch from 2640845 to 1f0691f Compare March 5, 2026 05:28

Merge branch 'x' into feat/cosmosEnigmaUtils

dbf22ef

devin-ai-integration bot reviewed Mar 5, 2026

View reviewed changes

chatgpt-codex-connector bot reviewed Mar 5, 2026

View reviewed changes

Merge branch 'x' into feat/cosmosEnigmaUtils

4065616

devin-ai-integration bot reviewed Mar 5, 2026

View reviewed changes

originalix approved these changes Mar 5, 2026

View reviewed changes

originalix disabled auto-merge March 5, 2026 06:36

originalix merged commit 4e5b37e into x Mar 5, 2026
11 checks passed

originalix deleted the feat/cosmosEnigmaUtils branch March 5, 2026 06:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/cosmos enigma utils OK-50764 OK-50786 OK-50962#10456

Feat/cosmos enigma utils OK-50764 OK-50786 OK-50962#10456
originalix merged 8 commits intoxfrom
feat/cosmosEnigmaUtils

ByteZhang1024 commented Mar 4, 2026 •

edited by devin-ai-integration bot

Loading

Uh oh!

revan-zhang commented Mar 4, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

Uh oh!

devin-ai-integration bot Mar 5, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Mar 5, 2026

Uh oh!

socket-security bot commented Mar 5, 2026

Uh oh!

socket-security bot commented Mar 5, 2026

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

devin-ai-integration bot Mar 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

ByteZhang1024 commented Mar 4, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

revan-zhang commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devin-ai-integration bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Mar 5, 2026

Uh oh!

socket-security bot commented Mar 5, 2026

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ByteZhang1024 commented Mar 4, 2026 •

edited by devin-ai-integration bot

Loading

revan-zhang commented Mar 4, 2026 •

edited

Loading