Fix/212 215 security and vault issues - #334
Open
nedu-sol wants to merge 4 commits into
Open
Conversation
Applies ethos-protocol#119's escalating OTP cooldown schedule (30s/60s/120s after 3/4/5+ failures) to the account-recovery flow on both platforms, since a recovery backup code is just as brute-forceable as an OTP. Surfaces remaining attempts/cooldown in the recovery UI and blocks submission while a cooldown is active. Closes ethos-protocol#212
Adds PII-scrubbed diagnostic logging (authenticator attachment type + WebAuthn attestation statement format) for passkey registration failures on both platforms, to help support triage device-specific WebAuthn quirks. Never logs public key material, signatures, challenge bytes, or credential IDs. Documents the scope in SECURITY.md. Closes ethos-protocol#213
Detects when the account has no other registered passkey (via the existing_credential_ids signal already used for excludeCredentials) and blocks sign-out behind a confirmation dialog, since losing the only passkey with no recovery in hand could permanently lock the user out of a vault holding real funds. Adds a minimal sign-out entry point to Android's vault list, matching the one already on iOS. Closes ethos-protocol#214
Vault creation commits real funds to a TTL-gated structure, but both platforms submitted straight from the input form. Adds a review step summarizing the beneficiary address and check-in interval, requiring explicit confirmation before the create-vault call fires. Adds tests for the confirm/cancel paths on both platforms. Closes ethos-protocol#215
|
@nedu-sol Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses four Stellar-wave security/UX issues across both mobile clients:
#212 — Rate-limit recovery-code submission attempts. Reuses the escalating cooldown schedule from #119's OTPRateLimiter/TwoFactorViewModel (30s/60s/120s after 3/4/5+ failures) for the account-recovery flow. Surfaces remaining attempts/cooldown in the recovery UI and blocks submission while blocked.
#213 — Log passkey attestation format for support diagnostics. On registration failure, logs authenticator attachment type + WebAuthn attestation format (fmt) in memory, PII-scrubbed — never public key material, signatures, challenge bytes, or credential IDs. Scope documented in SECURITY.md.
#214 — Warn before sign-out on the last registered passkey device. Detects when the account has no other registered passkey and blocks sign-out behind a confirmation dialog. Added a minimal sign-out entry point to Android's vault list (it didn't have one) to host the same guard iOS already has.
#215 — Add a vault-creation confirmation step. Both platforms now show a review screen summarizing beneficiary address + TTL before POST /vaults fires.
Test plan
iOS: run AuthStoreRecoveryRateLimitTests, PasskeyDiagnosticsLoggerTests, AttestationFormatExtractionTests, AuthStoreLastRemainingPasskeyTests + AuthUITests/VaultUITests
Android: run RecoveryRateLimiterAndroidTest, PasskeyServiceTest, AuthViewModelTest + VaultListScreenTest
Manually verify recovery-code cooldown (3 wrong codes → 30s lockout) on both platforms
Manually verify sign-out warning appears only when the account has one passkey
Manually verify vault creation shows the review screen and Back/Cancel don't submit
Closes #212
Closes #213
Closes #214
Closes #215