Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions packages/extension/src/libs/dapp-list/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,6 @@ const lists: Partial<Record<NetworkNames, string>> = {
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/bifrost.json',
[NetworkNames.Edgeware]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/edg.json',
[NetworkNames.ZkSyncGoerli]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/zksyncgoerli.json',
[NetworkNames.ZkSync]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/zksync.json',
[NetworkNames.Rootstock]:
Expand Down Expand Up @@ -75,8 +73,6 @@ const lists: Partial<Record<NetworkNames, string>> = {
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/godwoken.json',
[NetworkNames.ImmutableZkevm]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/imx.json',
[NetworkNames.ZChains]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/zchains.json',
[NetworkNames.MantaPacific]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/manta.json',
[NetworkNames.Mode]:
Expand All @@ -85,8 +81,6 @@ const lists: Partial<Record<NetworkNames, string>> = {
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/opBNB.json',
[NetworkNames.Palm]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/palm.json',
[NetworkNames.ProofOfPlayApex]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/popApex.json',
[NetworkNames.Scroll]:
'https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/dapps/scroll.json',
[NetworkNames.Rari]:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,6 @@ const NetworkEndpoints: Record<string, string> = {
[NetworkNames.Linea]: 'https://api.lineascan.build/api?',
[NetworkNames.MantaPacific]: 'https://pacific-explorer.manta.network/api?',
[NetworkNames.Mode]: 'https://explorer.mode.network/api?',
[NetworkNames.ProofOfPlayApex]: 'https://explorer.apex.proofofplay.com/api?',
[NetworkNames.Scroll]: 'https://api.scrollscan.com/api?',
[NetworkNames.Fraxtal]: 'https://api.etherscan.io/v2/api?chainid=252&',
[NetworkNames.Coti]: 'https://mainnet.cotiscan.io/api?',
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,6 @@ const supportedNetworks: Record<SupportedNetworkNames, SupportedNetwork> = {
tbName: 'astar',
cgPlatform: CoingeckoPlatform.Astar,
},
[NetworkNames.Okc]: {
tbName: 'okt',
cgPlatform: CoingeckoPlatform.Okc,
},
[NetworkNames.Optimism]: {
tbName: 'op',
cgPlatform: CoingeckoPlatform.Optimism,
Expand Down Expand Up @@ -155,10 +151,6 @@ const supportedNetworks: Record<SupportedNetworkNames, SupportedNetwork> = {
tbName: 'xlayer',
cgPlatform: CoingeckoPlatform.XLayer,
},
[NetworkNames.ProofOfPlayApex]: {
tbName: 'apex',
cgPlatform: undefined,
},
[NetworkNames.Godwoken]: {
tbName: 'ckb',
cgPlatform: CoingeckoPlatform.Godwoken,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,8 @@ const TokenList: Record<SupportedNetworkNames, string> = {
[NetworkNames.Mode]: `https://tokens.coingecko.com/${CoingeckoPlatform.Mode}/all.json`,
[NetworkNames.Moonbeam]: `https://tokens.coingecko.com/${CoingeckoPlatform.Moonbeam}/all.json`,
[NetworkNames.Moonriver]: `https://tokens.coingecko.com/${CoingeckoPlatform.Moonriver}/all.json`,
[NetworkNames.Okc]: `https://tokens.coingecko.com/${CoingeckoPlatform.Okc}/all.json`,
[NetworkNames.OpBNB]: `https://tokens.coingecko.com/${CoingeckoPlatform.OpBNB}/all.json`,
[NetworkNames.Optimism]: `https://tokens.coingecko.com/${CoingeckoPlatform.Optimism}/all.json`,
[NetworkNames.ProofOfPlayApex]: `https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/tokenlists/apex.json`,
[NetworkNames.Rari]: `https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/tokenlists/rari.json`,
[NetworkNames.Rollux]: `https://tokens.coingecko.com/${CoingeckoPlatform.Rollux}/all.json`,
[NetworkNames.Rootstock]: `https://raw.githubusercontent.com/enkryptcom/dynamic-data/main/tokenlists/rsk.json`,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ export type SupportedNetworkNames =
| NetworkNames.Ethereum
| NetworkNames.Matic
| NetworkNames.AstarEVM
| NetworkNames.Okc
| NetworkNames.Optimism
| NetworkNames.Moonriver
| NetworkNames.Moonbeam
Expand Down Expand Up @@ -59,7 +58,6 @@ export type SupportedNetworkNames =
| NetworkNames.Blast
| NetworkNames.Solana
| NetworkNames.XLayer
| NetworkNames.ProofOfPlayApex
| NetworkNames.Godwoken
| NetworkNames.Linea
| NetworkNames.MantaPacific
Expand Down
2 changes: 1 addition & 1 deletion packages/extension/src/providers/ethereum/networks/astr.ts
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ const astrOptions: EvmNetworkOptions = {
isTestNetwork: false,
currencyName: 'ASTR',
currencyNameLong: 'Astar',
node: 'wss://astar.public.blastapi.io/',
node: 'wss://astar.api.onfinality.io/public-ws',
icon,
coingeckoID: 'astar',
coingeckoPlatform: CoingeckoPlatform.Astar,
Expand Down
2 changes: 1 addition & 1 deletion packages/extension/src/providers/ethereum/networks/ftm.ts
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ const ftmOptions: EvmNetworkOptions = {
isTestNetwork: false,
currencyName: 'FTM',
currencyNameLong: 'Fantom',
node: 'wss://fantom-rpc.publicnode.com',
node: 'https://rpc.fantom.network',
icon,
coingeckoID: 'fantom',
coingeckoPlatform: CoingeckoPlatform.Fantom,
Expand Down
Binary file not shown.
Binary file not shown.
4 changes: 0 additions & 4 deletions packages/extension/src/providers/ethereum/networks/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,6 @@ import telosNode from './tlos';
import blastNode from './blast';
import sankoNode from './dmt';
import degenNode from './degen';
import zcdNode from './zcd';
import immutableZkevmNode from './immutable-zkevm';
import rariNode from './rari';
import formaNode from './forma';
Expand All @@ -52,7 +51,6 @@ import mantaPacificNode from './manta-pacific';
import modeNode from './mode';
import opbnbNode from './op-bnb';
import palmNode from './palm';
import proofOfPlayApexNode from './pop-apex';
import scrollNode from './scroll';
import cotiTestnetNode from './coti-testnet';
import hoodiNode from './hoodi';
Expand Down Expand Up @@ -126,7 +124,6 @@ export default {
blast: blastNode,
sanko: sankoNode,
degen: degenNode,
zcd: zcdNode,
immutableZkevm: immutableZkevmNode,
rari: rariNode,
forma: formaNode,
Expand All @@ -137,7 +134,6 @@ export default {
mode: modeNode,
opbnb: opbnbNode,
palm: palmNode,
popApex: proofOfPlayApexNode,
scroll: scrollNode,
cotiTestnetNode: cotiTestnetNode,
hoodi: hoodiNode,
Expand Down
2 changes: 0 additions & 2 deletions packages/extension/src/providers/ethereum/networks/okc.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import icon from './icons/okc.webp';
import { CoingeckoPlatform, NetworkNames } from '@enkryptcom/types';
import { EvmNetwork, EvmNetworkOptions } from '../types/evm-network';
import wrapActivityHandler from '@/libs/activity-state/wrap-activity-handler';
import assetsInfoHandler from '@/providers/ethereum/libs/assets-handlers/assetinfo-mew';

const okcOptions: EvmNetworkOptions = {
name: NetworkNames.Okc,
Expand All @@ -18,7 +17,6 @@ const okcOptions: EvmNetworkOptions = {
icon,
coingeckoID: 'oec-token',
coingeckoPlatform: CoingeckoPlatform.Okc,
assetsInfoHandler,
activityHandler: wrapActivityHandler(() => Promise.resolve([])),
};

Expand Down
2 changes: 1 addition & 1 deletion packages/extension/src/providers/ethereum/networks/palm.ts
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ const palmNetworkOptions: EvmNetworkOptions = {
isTestNetwork: false,
currencyName: 'PALM',
currencyNameLong: 'PALM',
node: 'https://palm-mainnet.public.blastapi.io',
node: 'https://palm-mainnet.infura.io/v3/3a961d6501e54add9a41aa53f15de99b',
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Security concern: Infura API key hardcoded in source code.

The Infura API key 3a961d6501e54add9a41aa53f15de99b is embedded directly in the source code. This exposes several risks:

  • The key is publicly visible in the repository and browser extension bundle
  • Anyone can extract and abuse this key, leading to rate limiting or service disruption for all users
  • If this is a paid Infura plan, it could result in unexpected costs
  • The key cannot be rotated without releasing a new version of the extension

Consider moving RPC endpoints with API keys to a secure configuration management system or using environment variables that are injected at build time.

Run the following script to check if other network files also hardcode API keys in their RPC endpoints:


🏁 Script executed:

#!/bin/bash
# Description: Check if other network files contain hardcoded API keys in RPC URLs

# Search for common API key patterns in network configuration files
rg -n -C 2 'node:.*\.(infura\.io|alchemy\.com|quicknode\.com).*[a-f0-9]{32}' packages/extension/src/providers/ethereum/networks/

Length of output: 473


</parameter>
</invoke>

---

🏁 Script executed:

```shell
#!/bin/bash
# List all network configuration files and show their RPC node URLs

fd -e ts 'packages/extension/src/providers/ethereum/networks/' -x sh -c '
  echo "=== {} ==="
  rg -n "node:" {} -A 0 -B 0
'

Length of output: 509


🏁 Script executed:

#!/bin/bash
# Check if the codebase uses environment variables or config management for RPC endpoints

rg -n "process\.env|import.*config|require.*config" packages/extension/src/providers/ethereum/networks/ -C 2 | head -50

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Check the .env or environment configuration files in the repository root

fd -e env -o -e example '\.(env|config)' | head -20

Length of output: 116


🏁 Script executed:

#!/bin/bash
# Check if there are any comments or documentation about RPC endpoint management

rg -n "RPC|endpoint|api.?key" packages/extension/src/providers/ethereum/networks/ -C 1 | head -50

Length of output: 556


</parameter>
</invoke>

---

🏁 Script executed:

```shell
#!/bin/bash
# List all network configuration files with correct fd syntax

fd . 'packages/extension/src/providers/ethereum/networks/' -e ts

Length of output: 5307


🏁 Script executed:

#!/bin/bash
# Examine a few other network files to see how they configure RPC endpoints

# Get first 3 network files (excluding index)
files=$(fd . 'packages/extension/src/providers/ethereum/networks/' -e ts | grep -v index.ts | head -3)

for file in $files; do
  echo "=== $file ==="
  rg -n "node:" "$file" -A 0 -B 0
  echo ""
done

Length of output: 347


🏁 Script executed:

#!/bin/bash
# Search entire codebase for environment variable patterns related to RPC or endpoints

rg -n "process\.env.*RPC|process\.env.*NODE|RPC_URL|NODE_URL" packages/extension/ | head -20

Length of output: 174


🏁 Script executed:

#!/bin/bash
# Check if .env files exist in the root or extension directories

find packages/extension -name ".env*" -o -name "*.env" 2>/dev/null | head -10

Length of output: 31


🏁 Script executed:

#!/bin/bash
# Examine the palm.ts file context to see if there's any configuration pattern

cat packages/extension/src/providers/ethereum/networks/palm.ts

Length of output: 1062


</parameter>
</invoke>

---

🏁 Script executed:

```shell
#!/bin/bash
# Check the .env.example file to see recommended configuration pattern

cat packages/extension/.env.example

Length of output: 41


🏁 Script executed:

#!/bin/bash
# Comprehensive search: show ALL node: definitions across all network files to ensure no missed API keys

rg -n "node:" packages/extension/src/providers/ethereum/networks/ --type ts

Length of output: 7885


🏁 Script executed:

#!/bin/bash
# Check if there's any documentation or comments about RPC endpoint management in the root README or docs

find . -maxdepth 2 -name "README*" -o -name "SECURITY*" 2>/dev/null | xargs grep -l "RPC\|API.key\|endpoint" 2>/dev/null | head -5

Length of output: 0


🏁 Script executed:

#!/bin/bash
# Search for any comments mentioning API key, security, or hardcoded in the networks directory

rg -n "API.?key|hardcod|secret|credential" packages/extension/src/providers/ethereum/networks/ -i

Length of output: 0


Security concern: Infura API key hardcoded in source code remains critical.

The verification confirms that palm.ts is the only network file among 80+ configurations that hardcodes an API key. While the comments document that Palm's native API is broken (DNS won't resolve), embedding the Infura key 3a961d6501e54add9a41aa53f15de99b directly in source code creates a persistent security and operational risk:

  • The key is publicly visible in the repository and extension bundle
  • Anyone can extract and abuse it, causing rate limiting or service disruption for all users
  • If this is a paid Infura plan, unexpected costs could occur
  • The key cannot be rotated without releasing a new extension version

All other 80+ networks use public endpoints without credentials, demonstrating that environment-based or build-time configuration is feasible. Move this key to environment variables injected at build time or use a secure credential management system.

🤖 Prompt for AI Agents
In packages/extension/src/providers/ethereum/networks/palm.ts around line 19,
the Infura API key is hardcoded which exposes credentials; replace the literal
URL by constructing the node URL from an environment/config variable (e.g. read
process.env.PALM_INFURA_KEY or a build-time injected variable) and failover to a
public/non-authenticated endpoint or throw a clear error if the env var is
missing; remove the hardcoded key from source, update the README/build scripts
to document the required env var, and ensure no secret is committed to the repo
or bundled in production builds.

icon,
coingeckoID: 'palm-ai',
activityHandler: wrapActivityHandler(() => Promise.resolve([])),
Expand Down
28 changes: 0 additions & 28 deletions packages/extension/src/providers/ethereum/networks/pop-apex.ts

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ const xlayerOptions: EvmNetworkOptions = {
isTestNetwork: false,
currencyName: 'OKB',
currencyNameLong: 'OKB',
node: 'wss://ws.xlayer.tech',
node: 'https://xlayerrpc.okx.com',
icon,
coingeckoID: 'okb',
coingeckoPlatform: CoingeckoPlatform.XLayer,
Expand Down
24 changes: 0 additions & 24 deletions packages/extension/src/providers/ethereum/networks/zcd.ts

This file was deleted.

2 changes: 0 additions & 2 deletions packages/hw-wallets/src/ledger/ethereum/configs.ts
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,8 @@ const supportedPaths = {
[NetworkNames.Arbitrum]: DEFAULT_PATHS,
[NetworkNames.Gnosis]: DEFAULT_PATHS,
[NetworkNames.Fantom]: DEFAULT_PATHS,
[NetworkNames.Klaytn]: DEFAULT_PATHS,
[NetworkNames.Base]: DEFAULT_PATHS,
[NetworkNames.Celo]: DEFAULT_PATHS,
[NetworkNames.Syscoin]: DEFAULT_PATHS,
[NetworkNames.Telos]: DEFAULT_PATHS,
[NetworkNames.Blast]: DEFAULT_PATHS,
};
Expand Down
2 changes: 0 additions & 2 deletions packages/types/src/networks.ts
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,6 @@ export enum NetworkNames {
Degen = "degen",
Ham = "ham",
XLayer = "XLayer",
ZChains = "ZCD",
ImmutableZkevm = "ImmutableZkevm",
Forma = "Forma",
Godwoken = "godwoken",
Expand All @@ -83,7 +82,6 @@ export enum NetworkNames {
Mode = "mode",
OpBNB = "OpBNB",
Palm = "palm",
ProofOfPlayApex = "ProofOfPlayApex",
Scroll = "scroll",
Rari = "rari",
CotiTestnet = "CotiTestnet",
Expand Down
Loading