@coinbase/wallet-sdk@4.3.6 security report

The code uses getFavicon() to retrieve the current site's favicon and collects app metadata (appName, appLogoUrl, appChainIds) by default. This data is sent to the telemetry system and potentially to the wallet provider. While not credential harvesting, it does access browser/environment data automatically upon instantiation.

viemHttpErrorToProviderError parses JSON from error.details. While JSON.parse is generally safe against code execution, the resulting object fields (message, data) may be attacker-controlled and could lead to unexpected behavior if consumed unsafely downstream. This is a minor input validation concern, not a malicious pattern.

The file defines functions that log analytics events for SCW signer handshake and request lifecycle (started, error, completed). It imports a store and logEvent utility, gathering context like method, correlationId, errorMessage, and enableAutoSubAccounts. No sensitive data exfiltration, credential harvesting, obfuscation, dynamic execution, or suspicious network/file/process operations are present. The logging appears to be standard product telemetry.

The loadTelemetryScript function is exported and may be called during module import or initialization, leading to automatic telemetry setup and data transmission without explicit user consent.

Both exported functions rely on window.ClientAnalytics without verifying its origin, integrity, or that it is a trusted, expected SDK instance. A malicious or compromised page script could override window.ClientAnalytics to intercept telemetry payloads, and this code would faithfully forward potentially sensitive data to it.

The bundle uses a custom webpack-style module loader with runtime-computed requires (n(2), n(353), n(762), etc.) and dynamic export assignment, plus UMD-style fallback attaching ClientAnalytics to the global object. This is normal bundler output but makes auditing harder and could mask malicious payloads in minified form.

The SDK conditionally loads a telemetry script via loadTelemetryScript() when options.preference.telemetry is not set to false. Telemetry can send usage data to external Coinbase servers, which is a potential privacy/data-exfiltration concern, though it is opt-out and part of the official Coinbase Wallet SDK design.

loadTelemetryScript dynamically loads an external script (telemetry init). If fetched from a remote origin without integrity verification, this could be an avenue for supply-chain injection, though here it is a first-party core module.

The module implements subaccount creation and owner-adding via EIP-1193 requests (wallet_addSubAccount, wallet_connect, wallet_sendCalls) and encodes ABI calls for on-chain owner management. This is expected wallet SDK behavior, not a drainer pattern, but warrants review to ensure no address rewriting or unauthorized signing occurs.

A storage instance is created at module top-level (export const storage = createStorage(...)), which executes on import. This is a common pattern but constitutes import-time side effect in third-party packages. It does not perform network or filesystem operations outside the storage scope visible here, but the actual behavior depends on createStorage which is not shown.

WebAuthn signing payloads are hardcoded to origin 'https://keys.coinbase.com'. This is expected for Coinbase SDK functionality but ties the cryptographic operations to a specific external domain; if this package were used outside that context or if the domain were spoofed, signatures could be produced for unintended relying parties.

getItem, setItem, and removeItem do not handle errors from idb-keyval. In a key-management context, a failed write or delete could leave stale or inconsistent key material, but no error is surfaced to the caller.

The scope and name arguments are passed directly to createStore without validation, allowing callers to choose arbitrary IndexedDB database/object store names. This could be abused to interfere with other components or to persist data in unexpected locations.

The code sends encrypted requests to a popup communicator and fetches chain/RPC metadata, but uses standard cryptographic helpers and known SDK URLs rather than obvious exfiltration endpoints.

Unrecognized JSON-RPC requests are forwarded to a chain RPC URL, and coinbase_fetchPermissions calls the hardcoded CB_WALLET_RPC_URL; these are expected provider behaviors, not malicious exfiltration.

This module implements a signer type selection and wallet link session handshake mechanism for a cryptocurrency wallet SDK (likely Coinbase Wallet SDK, given 'CBWSDK' namespace). It handles wallet connection types (SCW and WalletLink) but does not contain obvious exfiltration, credential harvesting, or key theft patterns. However, it is security-sensitive code managing wallet sessions and signer selection, which warrants scrutiny in a supply chain context.

Module-level instantiation of ScopedLocalStorage runs at import time. While not inherently malicious in this context, top-level side effects on import can be a concern if the storage scope is manipulated or if this is used to persist sensitive state unexpectedly.

The code sends data to a Coinbase Wallet link server URL (linkAPIUrl). While this is expected for a wallet SDK, it includes broadcasting origin and location (location.origin, location.href) along with encrypted event data, which could be used for tracking or analytics. This is a privacy concern but not necessarily malicious.

The code uses session secrets and keys (session.secret, session.key) for encryption and authentication. While this is necessary for the SDK's functionality, it handles sensitive cryptographic material. However, no harvesting of external credentials (e.g., .npmrc, ~/.ssh) is observed.

No use of eval, Function constructor, or other dynamic code execution mechanisms was found.

The code makes WebSocket connections and HTTP requests to a configurable linkAPIUrl. This is expected for a wallet connection SDK, but it could be a vector for data exfiltration if the URL is controlled by an attacker. No hardcoded suspicious external URLs were found.

No file system operations (reading, writing, deleting files) were observed.

No spawning of child processes or shell commands was detected.

This is a library file, not a script that runs at install time. It is part of a larger package (likely @coinbase/wallet-sdk), and its import-time behavior is limited to class definition and constant initialization.

The constructor encodes the session key into a Basic Authorization header. While not inherently malicious, this pattern could expose sensitive session material in network logs or if the endpoint is intercepted. It is a standard practice for some wallet relay protocols but warrants review.

The code sends authenticated POST and GET requests to a user‑provided linkAPIUrl. If an attacker can control this URL (e.g., via a compromised configuration), session data could be exfiltrated. However, this is expected functionality for a wallet relay client.

Session secret is stored in browser storage (localStorage/sessionStorage) via STORAGE_KEY_SESSION_SECRET. While this is a common pattern for session management, secrets stored in browser storage are accessible to any JavaScript running on the same origin, which could be a concern if there is an XSS vulnerability. However, this is not a malicious pattern and is standard for such SDKs.

A synthetic anchor element is created and clicked programmatically to navigate to an external deeplink, and a setTimeout is used to trigger a second redirect dialog. This pattern bypasses expected user interaction and could be abused to force navigation without explicit consent.

The code embeds two base64-encoded SVG images as data URIs (Coinbase logo and gear icon). These are decoded and rendered as images, not evaluated as code. The decoded SVGs appear to be legitimate UI icons with no script content.

createQrUrl embeds sessionSecret (a shared secret) into a URL query string, which may be exposed via browser history, referrer headers, server logs, or QR code scanning.

getLocation attempts to read window.top.location when in an iframe. While guarded by try/catch, accessing parent/top location is blocked by same-origin policy and this pattern is sometimes used to probe embedding context.

The encrypt function uses a 12-byte (96-bit) IV for AES-GCM, which is standard. However, the IV is randomly generated with crypto.getRandomValues, which is cryptographically secure. No immediate issue. But note: deriveSharedSecret uses ECDH with P-256 and derives an AES-GCM key, which is secure. No direct malicious pattern.

exportKeyToHexString exports private keys as pkcs8 and public keys as spki, and importKeyFromHexString imports them with extractable=true for both public and private keys. This allows private key extraction, which could be a security concern if keys are mishandled, but it is not inherently malicious. It is a design choice for key serialization.

encryptContent serializes Error objects by including error.code and error.message. This could inadvertently expose sensitive information in error messages when encrypted content is later decrypted. However, this is a functional behavior, not a malicious pattern.

The fetchRPCRequest function uses window.fetch to send arbitrary JSON-RPC requests to a caller-provided rpcUrl. While expected for a wallet SDK, this constitutes a network egress primitive that could be abused to exfiltrate wallet-related data if rpcUrl is attacker-controlled.

Requests include X-Cbw-Sdk-Version and X-Cbw-Sdk-Platform headers, fingerprinting the SDK/version/platform to the remote RPC endpoint. Combined with arbitrary rpcUrl this could leak client environment details to third parties.

The code imports and calls telemetry functions (logSnackbarActionClicked, logSnackbarShown) which may send user interaction data to external servers. While common for analytics, this could be a privacy concern if data is exfiltrated without user consent. The telemetry destination is not visible in this file, so it cannot be fully assessed.

The code contains a Webpack module loader that evaluates modules dynamically using e[r].call(a.exports, a, a.exports, n). While this is standard Webpack bundling behavior, it constitutes dynamic code execution and could be abused if module IDs or content are attacker-controlled. The presence of Function constructor or eval is not directly observed, but the module system allows runtime execution of bundled code.

The code uses IndexedDB (keyval-store) to persist analytics data such as event IDs, session IDs, and user IDs across sessions. This is standard for analytics but enables long-term tracking.