Internet Money Wallet

Two environment variable files `.env.development` and `.env.production`, are found in the `backend-nodejs` folder. Many important accounts, secrets, and API keys are re-used between the development and the production environment.

The application uses the crypto-js's EVPKDF derivation function, which does a single iteration of the MD5 hash function to generate the encryption key. MD5 hash algorithm is not a key derivation function. The code below from [crypto-js library](https://github.com/brix/crypto-js/blob/971c31f0c931f913d22a76ed488d9216ac04e306/src/evpkdf.js), shows the configuration used in the derivation function: ```typescript=22 cfg: Base.extend({ keySize: 128/32, hasher: MD5, iterations: 1 }), ```

The application generates the password hash by doing a double "keccak256", which is considered an insecure way to perform the password hashing. ```js export const getPasswordHash = (password) => { const web3 = new Web3(); try { return web3.utils.keccak256(web3.utils.keccak256(password.toString())); } catch (error) { return null; } }; ```

The mnemonic phrase is a list of words that can be used to recover a wallet account. Obtaining the mnemonic can potentially allow the attacker to gain full control of the wallet. The application neither has a mechanism in place to stop a user from taking the screenshot of the displayed wallet secrets nor display a warning to remind the user of the risk of taking a screenshot.

WBNB is the wrapped version of the native BSC token BNB. BNB should always be able to redeem with a 1-1 ratio for WBNB. The application display a UI claim the BNB to WBNB flow is a "swap" and provides the "SushiSwap/PancakeSwap" as an option. After selecting one of the DEX options and submitting the transaction, the transaction will always revert.

On mobile devices, a screenshot of the current activity is taken when an application goes into the background and displayed for aesthetic purposes when the app returns to the foreground. This feature may pose a security risk. Sensitive data may be exposed if the user background the application while sensitive data is displayed. A malicious application that is running on the device and able to continuously capture the screen may also expose data.

When users want to swap one token for another, the wallet application requires the user to approve the maximal token allowance for the "https://bscscan.com/address/0x02a060a1bb096572b3d6a67e20f8cdf48c92d7d4" contract. The contract is unverified in the blockchain explorer.

App Transport Security (ATS) is a set of security checks that the operating system enforces when making connections with NSURLConnection, NSURLSession and CFURL to public hostnames. ATS is enabled by default for applications build on iOS SDK 9 and above. During the pentest, it is observed that on the iOS App, the App Transport Security restrictions are disabled for all network connections. Disabling ATS means that unsecured HTTP connections are allowed. HTTPS connections are also allowed and are still subject to default server trust evaluation. However, extended security checks like requiring a minimum Transport Layer Security (TLS) protocol version are disabled. - https://developer.apple.com/documentation/bundleresources/information_property_list/nsapptransportsecurity - https://cwe.mitre.org/data/definitions/919.html

The extension wallet allows users to import custom tokens, and display the token name and symbol in the wallet UI. The ERC20 token contract standard doesn't have any restrictions on any of the token properties, and anyone can deploy token contracts on the blockchain. Once a token is added, the wallet will fetch the information and display them in it's interface.

No root or jailbreak detection is implemented in the application. This allows an attacker to modify the app on a rooted Android or jailbroken iOS device, which means the attacker can potentially induce behaviors that otherwise would not occur. Examples of the impact include accessing sensitive application data, overwriting critical functions, and an overall wider attack surface.