Skip to content

Audit: long nested SNIP-12 key paths hide the signed values on the approval card (Sherlock 257) #585

Closed

Description

@derek-flossman

Tracking issue for Sherlock #257 (Low/Info) and Sherlock #187 (Low/Info), targeted at v0.10.6.

  • 257: the sign card composes one SNIP-12 name per nesting level into an unbounded dotted key, laid out at full width (flex: none). An ordinary nested order shows its signed recipient, amount and nonce at zero visible pixels while Sign is offered.
  • 187: an unbounded domain name pushes the approval summary over the panel's 300-character limit, so the approval is dropped and the site's request hangs with nothing on screen.

Fix: let the key wrap, keep half the row for the value, withhold Sign past a key-length bound, and cut the summary's names at 64 characters.

Activity

  1. derek-flossman commented on Oct 12, 2026

    @derek-flossman
    CollaboratorAuthor

    Fixed on release/v0.10.6 by #636 (merge commit 7eb9028).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions