From 9eb9311cb50bfac90c1a625cdf5bd4eddb3f6156 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 4 Nov 2026 16:52:03 +0000 Subject: [PATCH] Review of 2026-11-04: Cross_Chain's list of changes, tracked in WALLET-BACKLOG with the other repositories' Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01LyvXroLy77GnnctsMuDW8x --- WALLET-BACKLOG.md | 9 +++++++++ tools/audits/2026-11-04-review.md | 31 +++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+) create mode 100644 tools/audits/2026-11-04-review.md diff --git a/WALLET-BACKLOG.md b/WALLET-BACKLOG.md index 9df038a..047fb9d 100644 --- a/WALLET-BACKLOG.md +++ b/WALLET-BACKLOG.md @@ -84,6 +84,15 @@ item when its PR (or, for the app, its release) is done. could not verify (validation not VALID), or whose calls are shown only by their function selector: those are at most "Da controllare". The page only; the app and the extension take it with the page. +8. **The review of 2026-11-04: what to change, per repository** (decided by the maintainer item by item; + the ones that are not serious may stay open). The full reports are private until the fixes are + released; then `AUDIT.md` gets the public summary, with the 2026-10-29 Codex one. + - Cross_Chain (site, page, relayer): [tools/audits/2026-11-04-review.md](tools/audits/2026-11-04-review.md); + - extension: `up-wallet-extension/audits/2026-11-04-review.md`; + - app: `up-wallet-android/audits/2026-11-04-review.md`; + - signing service (private): `cross-chain-sponsor/audits/2026-11-04-review.md`. + Items 6 and 7 above and the LUKSO page's three changes (Other pages, 1) are part of it. + ## Other pages 1. **The LUKSO authorization page: live tests, then the review** (2026-11-03). `up-authorize-lukso.html` diff --git a/tools/audits/2026-11-04-review.md b/tools/audits/2026-11-04-review.md new file mode 100644 index 0000000..420f9bb --- /dev/null +++ b/tools/audits/2026-11-04-review.md @@ -0,0 +1,31 @@ +# Review of 2026-11-04: what to change in Cross_Chain + +The review of the release of 2026-11-03 (page 0.14.0 and the LUKSO authorization page, Cross_Chain @ `0384f03`, +with the app 0.10.0, the extension 0.1.9 and the signing service), made right after it by two models of +different providers (Claude and Codex), as the review policy says (`AUDIT.md`). Not a professional audit. +The full reports stay private until the fixes are released; then `AUDIT.md` gets the public summary. +`WALLET-BACKLOG.md` (item 8) tracks this file with those of the other repositories. + +The reviewers found no path that moves funds, changes a UP's permissions or obtains an unintended signature +without the user approving it in their own wallet; the three contracts rebuild byte for byte from the +committed sources, on every chain. The new LUKSO authorization page: no logic error. + +Status: **Proposed** (decision to confirm), **To do**, **Accepted**, **Done** (with the commit). + +| ID | Sev. | Where | What to change | Status | +|---|---|---|---|---| +| CC-01 | Medium | Relayer | The per-UP limit charged only after the operation's shape and signature checks (or after the simulation), with a separate global cap; a cache of a few seconds on `/relay/info` (A10); a `limit_req` zone in nginx on `/relay/` | Proposed | +| CC-02 | Medium | Site, web wallet | One privacy notice for the site and the web wallet, linked from every footer: controller, purposes, legal bases, every recipient (Reown, Alchemy, Blockscout and LUKSO's explorer, universalprofile.cloud, ipfs.io, envio, CoW, LI.FI, cdnjs, the SMTP provider, the VPS host), retention as configured, rights, the Garante. The app's notice fixed (the relayer on by default). `relay/sponsor/check` called only when the relayer box is used | Proposed | +| CC-03 | Low | `up-subscribe.html` | The subscription's notice with the Art. 13 items (controller and contact, basis = contract, processors, retention, rights, Garante); erasure by e-mail | Proposed | +| CC-04 | Low | `up-authorize-lukso.html` | The "public, no personal data" note next to the device name, as on the Backup page | Proposed | +| CC-05 | Low | `up-authorize-lukso.html`, `up-backup.html` | An address that comes from a link: the user types its last characters as shown by the device's panel, instead of a tick box; the device name not pre-filled from the link | Proposed | +| CC-06 | Low | `up-wallet.html` | The "same site" ticks (SIWE, Hup chat, CIE Link) only when WalletConnect's verification is VALID; otherwise "site not verified" | Proposed | +| CC-07 | Low | Site | HSTS (maintainer, nginx, without `includeSubDomains`); deprecated pages out of the web root; `.htaccess` aligned with nginx's dot-path rule | Proposed | +| CC-08 | Low | Relayer | The monitor without access to the relayer's key (separate user or `InaccessiblePaths`); systemd directives; Nodemailer ≥ 10.1.4 (A09); journald retention set to the stated 30 days | Proposed | +| CC-09 | Info | `up-authorize-lukso.html` | `chainId` in its transaction, as on every other page | Proposed | +| CC-10 | Info | Relayer | The L1 fee at the effective price; the per-UP lock kept until the nonce is used; the operation recorded before broadcasting | Proposed | +| EXT-02 | Medium | `up-wallet.html` | Typed data: the warnings on the type computed from `types`, not on the request's `primaryType` (with `sign-plan.js` in the app and the extension) | Proposed | +| A05 | Low | Site | WalletKit's license also as `.txt`, linked from the page (from 2026-10-29) | To do | +| A06 | Low | Contracts' metadata | `"status"` of the contract manifests updated (deployed on five chains) | To do | +| Codex | — | Site | The server's CSP header allows inline scripts: not shared, the pages' own policy allows only hashed scripts and both apply (CSP-1, accepted) | Accepted | +| Docs | — | README, site | "Self-hosted, no third-party providers" and "Chain Integrate holds nothing" made precise (public RPCs, Alchemy, Reown, explorers; the subscription's prepaid balance) | Proposed |