[New Snap] Stellar

[khanti42]

Checklist

All items in the list below needs to be satisfied.

• Is the Snap repository publicly accessible and linked in this ticket: https://github.com/paulfears/StellarSnap
• Is the Snap distributed on npm and linked in this ticket: https://www.npmjs.com/package/stellar-snap?activeTab=readme
• Has an audit been performed and the audit report attached or linked in this issue?
• Is a complete list of discovered vulnerabilities from the audit documented in this issue?
• For vulnerabilities that have been deemed necessary to be addressed, are the links to the fixes attached to this issue?
• For vulnerabilities that have been deemed not necessary to be addressed, is a reason for each of them documented in this issue?
• The corresponding pull request in this repo has been merged.

Audit Details

Audit : https://github.com/paulfears/StellarSnap/tree/main/audits/Cure53%20V1.0.6
Audit Highlights: https://github.com/paulfears/StellarSnap/tree/main/audits/Cure53%20V1.0.6/auditHighlights

Identified Vulnerabilities

1. Critical

• KYR-01-001: Private key leakage via setCurrentAccount RPC method.
  • Affected file: /src/Wallet.ts.
  • Impact: Potential exposure of private keys to malicious dApps.
  • Status: Fixed during the audit.

2. Medium

• KYR-01-002: Markdown and control characters allowed in dialogs.
  • Impact: Potential UI manipulation for user spoofing.
  • Status: Fixed.
• KYR-01-003: Account renaming without user confirmation.
  • Impact: Potential for confusion or trickery by malicious dApps.
  • Status: Fixed.
• KYR-01-004: Omission of dApp origin in Snap UI dialogs.
  • Impact: Users can be misled into performing unintended actions.
  • Status: Fixed.

3. Low

• KYR-01-005: Lack of parameter validation for RPC requests.
  • Impact: Potential for misbehavior from malicious input.
  • Status: Fixed.
• KYR-01-006: clearState altering wallet without confirmation.
  • Impact: Risk of wallet state resets without user consent.
  • Status: Fixed.

Miscellaneous Findings

• Observed security weaknesses, though not immediately exploitable.
• Recommendations included strict parameter validation and improved user interaction design.

[khanti42]

We asked if the audit could be put in the official website of Cure53 here: https://cure53.de/#publications. Not sure if this is a requirements to proceed further.