You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Audit: long nested SNIP-12 key paths hide the signed values on the approval card (Sherlock 257) #585
257: the sign card composes one SNIP-12 name per nesting level into an unbounded dotted key, laid out at full width (flex: none). An ordinary nested order shows its signed recipient, amount and nonce at zero visible pixels while Sign is offered.
187: an unbounded domain name pushes the approval summary over the panel's 300-character limit, so the approval is dropped and the site's request hangs with nothing on screen.
Fix: let the key wrap, keep half the row for the value, withhold Sign past a key-length bound, and cut the summary's names at 64 characters.
Activity
derek-flossman commentedon Oct 12, 2026
Fixed on release/v0.10.6 by #636 (merge commit 7eb9028).