📦
審計紀錄
okx-defi - 1 審計
審計版本 1 最新
2026年10月28日 下午02:47
All 84 static matches are benign Markdown, DeFi parameters, documentation links, or explicit private-key noncustody language. Two semantic risks remain: automatic unpinned installer execution and signing opaque transaction responses without documented semantic verification. User confirmation and sequential execution mitigate some risk; no evidence found of credential exfiltration or audit-targeted prompt injection.
8
已掃描檔案
1,347
分析行數
5
複核項目
0
已忽略的誤報
已確認的安全問題 (2)
高
Opaque Transaction Signing Without Documented Semantic Verification
The wallet flow passes returned targets, payloads, and values directly into signing and forbids inspecting rejected payloads. User confirmation is required, but no documented decoding or simulation verifies approval scope or intended asset movements before signing.
Direct wallet signing and the inspection prohibition are explicit. External wallet safeguards may reduce exposure, but their implementation is outside these files.
中
Automatic Unpinned Installer Execution
The mandatory preflight delegates to a bundled fallback that runs npx -y @okxweb3/onchainos-installer without a package version pin. This permits mutable registry code to execute before ordinary queries, without a separate installation-consent step.
The entry point requires preflight each thread, and the reviewed fallback specifies the unpinned npx command. No evidence found of malicious package contents.
風險因素
⚙️ 外部命令 (16)
🌐 網路存取 (1)
📁 檔案系統存取 (1)
審計單位: codex