Security review: 12 new findings in frontend packages and configuration

[cursor]

Security Review Findings

Thorough security review of packages/webapp-prove, packages/dapp-verify, packages/common, packages/notary, and root configuration files. Excludes the 7 already-known issues (committed private keys, SGX debug mode, notary auth disabled, missing Cargo.lock, unverified proof public key, curl|bash supply chain, SGX manifest key protection).

Summary: 12 new findings

HIGH (3):

• Notary/WebSocket proxy connections use plaintext HTTP/WS in dapp-verify (vs HTTPS/WSS in webapp-prove)
• URL query parameter controls faucet endpoint → client-side SSRF leaking burner wallet address
• Unvalidated worldAddress and chainId from URL params → victim interacts with attacker's contract

MEDIUM (8):

• Vite fs.strict: false disables filesystem access restrictions on dev server
• Wildcard /* proxy rule creates open proxy / recursive loop
• Production source maps enabled (sourcemap: true) exposing full source code
• target="_blank" links missing rel="noopener noreferrer" → reverse tabnabbing
• Burner wallet private key stored unprotected in localStorage
• No Content-Security-Policy configured anywhere (HTML, Vite, Vercel)
• Committed build artifacts with source maps in dapp-verify/build/ and public/
• DEBUG logging level in notary production config leaks sensitive session data

LOW (1):

• initialBlockNumber URL param parsed without validation → client-side DoS

File added

• security-findings.json — complete findings with severity, attack paths, evidence, and remediation for each issue