Confirmation screen states that nothing will leave the account while approving an unrestricted transfer
- Severity
- Critical
- Class
- Wallet & client safety
- System
- Browser wallet extension
A connected application gets the user to sign a fund-moving transaction under a screen that assures them nothing can leave their account, draining balances and tokens.
A wallet's job at signing time is to tell the truth about what a transaction does. This one didn't. A particular value in the request was accepted in a shape the safety check never expected, so the guard that decides "can anything leave this account" quietly fell through to its permissive branch.
The result was the worst kind of mismatch: the screen affirmatively told the user their funds were safe while the transaction being broadcast could move everything they held.
Why it rated Critical
It needed no privileged position — any application the user had already connected to could trigger it — and it defeated the one screen a user relies on to stay safe. I confirmed the behaviour against the published, shipping build, not a development branch.
The fix class
Normalise and strictly validate the field before any safety decision reads it, and fail closed: if the guard can't prove funds are protected, it must say so.
