Adversarial dApp audit suite

Three steps

# 1. Build the extension (Rust changes also need pnpm wasm:build)
pnpm --filter @ozone/extension build

# 2. Start fresh — isolated from the regular test profile
rm -rf /tmp/Loroco-PW-Security

# 3. Run
node scripts/security/pw-security-audit.mjs

The suite imports a wallet with the fixed test mnemonic, then probes the attacker dApp from https://attacker.example/ (served via Playwright route()). Output is a pass/fail line per attack:

[sec] === ATTACK 01: unconnected read ===
[sec]    ✓ DEFENSE HELD — got code=4001 "https://attacker.example is not connected"
[sec] === ATTACK 09: spoof approval message ===
[sec]    ✗ DEFENSE FAILED — approval was accepted from page context

A ✓ DEFENSE HELD means the attack was blocked. A ✗ DEFENSE FAILED is a real finding — the script exits 1 and prints what got through.

Attack matrix

Adding a new attack

Each attack is a function registered in the ATTACKS array. Cases are independent — the suite runs them sequentially against a single persistent context, but none may rely on state from another.

{
  id: "13",
  name: "describe the attack",
  run: async ({ attacker, popup, ctx, sw, victim }) => {
    // Drive the page / iframes / SW probe.
    const out = await attacker.evaluate(...);
    return {
      held: /* true = defense held, false = attack succeeded */,
      detail: "human description for the log line",
    };
  },
}

Hardening status

These were the documented weak spots. Here's what changed — and the residual risk that remains, stated plainly.