; // XSS! }; // SECURE: React's default escaping const UserProfile = ({ bio }: { bio: string }) => { return

{bio}

; // Automatically escaped }; // If HTML is necessary, sanitize first import DOMPurify from 'dompurify'; const UserProfile = ({ bio }: { bio: string }) => { const sanitized = DOMPurify.sanitize(bio); return

; }; ``` ### URL Handling ```typescript // VULNERABLE: Unvalidated redirect const handleCallback = () => { const returnUrl = new URLSearchParams(window.location.search).get('returnUrl'); window.location.href = returnUrl!; // Open redirect! }; // SECURE: Validate redirect URL const handleCallback = () => { const returnUrl = new URLSearchParams(window.location.search).get('returnUrl'); const allowed = ['/', '/dashboard', '/profile']; if (allowed.includes(returnUrl || '')) { window.location.href = returnUrl!; } else { window.location.href = '/'; // Default safe redirect } }; ``` ## 5. API Communication Security ### HTTPS Enforcement ```typescript // VULNERABLE: HTTP connection const API_URL = 'http://api.example.com'; // Insecure! // SECURE: Always HTTPS const API_URL = 'https://api.example.com'; // Verify in code: all API URLs must use https:// ``` ### Request/Response Validation ```typescript // VULNERABLE: Trusting API response blindly const balance = await fetch('/api/balance').then(r => r.json()); displayBalance(balance.amount); // What if API is compromised? // SECURE: Validate response structure const response = await fetch('/api/balance').then(r => r.json()); if (typeof response.amount !== 'string' || !/^\d+$/.test(response.amount)) { throw new Error('Invalid balance response'); } displayBalance(response.amount); ``` ## 6. Audit Tools and Techniques ### Network Traffic Analysis ```bash # Use browser DevTools Network tab to inspect: # - All API requests and responses # - Transaction data being sent # - Headers (especially Authorization) # - WebSocket messages # Or use proxy tools: # - Burp Suite # - mitmproxy # - Charles Proxy ``` ### Code Review Patterns ```bash # Search for dangerous patterns grep -r "localStorage" src/ grep -r "dangerouslySetInnerHTML" src/ grep -r "eval(" src/ grep -r "privateKey\|mnemonic\|seed" src/ grep -r "console.log" src/ # Check for sensitive data logging ``` ### Browser Security Headers Check ``` Content-Security-Policy: default-src 'self'; script-src 'self' X-Frame-Options: DENY X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin ``` ## 7. Authentication Flow Audit ### Wallet Connection ```typescript // Verify wallet connection flow: // 1. User initiates connection // 2. Wallet provider prompts for approval // 3. Only public address shared with dApp // 4. No private data transmitted // Check UnlockPanelManager usage const unlockPanelManager = UnlockPanelManager.init({ loginHandler: () => { // Verify: no sensitive data handling here navigate('/dashboard'); } }); ``` ### Session Management ```typescript // Verify session security: // - Token expiration enforced // - Logout clears all session data // - No persistent sensitive storage const handleLogout = async () => { const provider = getAccountProvider(); await provider.logout(); // Verify: session storage cleared sessionStorage.clear(); navigate('/'); }; ``` ## 8. Audit Checklist ### Transaction Security - [ ] All transaction data validated before signing - [ ] User shown clear transaction preview - [ ] Recipient addresses validated - [ ] Amount confirmations for large transfers - [ ] Gas limits appropriate for operation ### Data Security - [ ] No private keys in any storage - [ ] No sensitive data in console logs - [ ] Access tokens not exposed in URLs - [ ] HTTPS enforced for all API calls ### XSS Prevention - [ ] No `dangerouslySetInnerHTML` with user input - [ ] No `eval()` with user input - [ ] URL redirects validated - [ ] Content-Security-Policy headers present ### Session Security - [ ] Token expiration enforced - [ ] Logout clears all session data - [ ] Protected routes properly guarded - [ ] Re-authentication for sensitive operations ## 9. Report Template ```markdown # dApp Security Audit Report ## Scope - Application: [name] - Version: [version] - Files reviewed: [count] ## Findings ### Critical | ID | Description | Location | Recommendation | |----|-------------|----------|----------------| | C1 | ... | ... | ... | ### High ... ### Medium ... ### Informational ... ## Recommendations Summary 1. [Priority recommendation] 2. ... ## Conclusion [Overall assessment] ``` # Frontend Audit (Expert) --- name: mvx_dapp_audit description: Auditing dApps and standard Frontend flows. --- # MultiversX dApp Auditor This skill helps you audit the frontend components of a MultiversX application (`sdk-dapp`). ## 1. Transaction Construction - **Critical Logic**: The frontend constructs the payload. - **Attack**: Can a malicious frontend user change the payload before signing? - Example: `func@args` -> `func@evil_args`. - **Mitigation**: The Smart Contract MUST validate everything. Do not trust the frontend to validate inputs. ## 2. Signing Security - **Blind Signing**: Does the dApp verify what it asks the user to sign? - **Hash Signing**: Is the user signing a hash (opaque) or a clear message? ## 3. Sensitive Data - **Local Storage**: Is the private key or mnemonic ever stored in `localStorage`? (Should NEVER be). - **XSS**: Can an attacker extract the `accessToken`? ## 4. Tools - **Burp Suite**: Proxy traffic to see what the dApp sends to the API or Blockchain Proxy. - **Inspect Element**: Check network tab for `POST /transactions` payloads. # SDK JS Core --- name: mvx_sdk_js_core description: Core SDK operations for MultiversX TypeScript/JavaScript - Entrypoints, Network Providers, and Transactions. --- # MultiversX SDK-JS Core Operations This skill covers the fundamental building blocks of the `@multiversx/sdk-core` v15 library. ## Entrypoints Network-specific clients that simplify common operations: | Entrypoint | Network | Default URL | |------------|---------|-------------| | `DevnetEntrypoint` | Devnet | `https://devnet-api.multiversx.com` | | `TestnetEntrypoint` | Testnet | `https://testnet-api.multiversx.com` | | `MainnetEntrypoint` | Mainnet | `https://api.multiversx.com` | | `LocalnetEntrypoint` | Local | `http://localhost:7950` | ```typescript import { DevnetEntrypoint } from "@multiversx/sdk-core"; // Default API const entrypoint = new DevnetEntrypoint(); // Custom API const entrypoint = new DevnetEntrypoint({ url: "https://custom-api.com" }); // Proxy mode (gateway) const entrypoint = new DevnetEntrypoint({ url: "https://devnet-gateway.multiversx.com", kind: "proxy" }); ``` ## Entrypoint Methods | Method | Description | |--------|-------------| | `createAccount()` | Create a new account instance | | `createNetworkProvider()` | Get underlying network provider | | `recallAccountNonce(address)` | Fetch current nonce from network | | `sendTransaction(tx)` | Broadcast single transaction | | `sendTransactions(txs)` | Broadcast multiple transactions | | `getTransaction(txHash)` | Fetch transaction by hash | | `awaitCompletedTransaction(txHash)` | Wait for finality | ## Network Providers Lower-level network access: | Provider | Use Case | |----------|----------| | `ApiNetworkProvider` | Standard API queries (recommended) | | `ProxyNetworkProvider` | Direct node interaction via gateway | ```typescript const provider = entrypoint.createNetworkProvider(); // Or manual instantiation import { ApiNetworkProvider } from "@multiversx/sdk-core"; const api = new ApiNetworkProvider("https://devnet-api.multiversx.com", { clientName: "my-app", requestsOptions: { timeout: 10000 } }); ``` ## Provider Methods | Method | Description | |--------|-------------| | `getNetworkConfig()` | Chain ID, gas settings, etc. | | `getNetworkStatus()` | Current epoch, nonce, etc. | | `getBlock(blockHash)` | Fetch block data | | `getAccount(address)` | Account balance, nonce | | `getAccountStorage(address)` | Contract storage | | `getTransaction(txHash)` | Transaction details | | `awaitTransactionCompletion(txHash)` | Wait for finality | | `queryContract(query)` | VM query (read-only) | ## Transaction Lifecycle ```typescript // 1. Create account and sync nonce const account = await Account.newFromPem("wallet.pem"); account.nonce = await entrypoint.recallAccountNonce(account.address); // 2. Create transaction (via controller) const controller = entrypoint.createTransfersController(); const tx = await controller.createTransactionForTransfer( account, account.getNonceThenIncrement(), { receiver, nativeAmount: 1000000000000000000n } ); // 3. Send const txHash = await entrypoint.sendTransaction(tx); // 4. Wait for completion const result = await entrypoint.awaitCompletedTransaction(txHash); console.log("Status:", result.status); ``` ## Best Practices 1. **Always sync nonce** before creating transactions 2. **Use `awaitCompletedTransaction`** for critical operations 3. **Handle errors** - network calls can fail 4. **Use appropriate timeouts** for long operations 5. **Batch transactions** when possible with `sendTransactions()` # SDK JS Wallets --- name: mvx_sdk_js_wallets description: Wallet and key management for MultiversX TypeScript/JavaScript SDK. --- # MultiversX SDK-JS Wallets & Signing This skill covers account management, key derivation, and transaction signing. ## Account Creation ```typescript import { Account, Address, Mnemonic, UserWallet, UserPem } from "@multiversx/sdk-core"; // From PEM file (testing only - not secure) const account = await Account.newFromPem("wallet.pem"); // From keystore (production) const account = await Account.newFromKeystore("wallet.json", "password"); // From entrypoint (generates new) const account = entrypoint.createAccount(); ``` ## Mnemonic Operations ```typescript // Generate new mnemonic (24 words) const mnemonic = Mnemonic.generate(); const words = mnemonic.getWords(); // Derive keys const secretKey = mnemonic.deriveKey(0); // First account const publicKey = secretKey.generatePublicKey(); const address = publicKey.toAddress(); ``` ## Wallet Storage ```typescript // Save mnemonic to keystore const wallet = UserWallet.fromMnemonic({ mnemonic: mnemonic.toString(), password: "secure-password" }); wallet.save("wallet.json"); // Save secret key to keystore const wallet = UserWallet.fromSecretKey({ secretKey: secretKey, password: "secure-password" }); wallet.save("wallet.json"); // Save to PEM (testing only) const pem = new UserPem(address.toBech32(), secretKey); pem.save("wallet.pem"); ``` ## Transaction Signing ```typescript // Controller-created transactions are auto-signed const tx = await controller.createTransactionForTransfer(account, nonce, options); // tx.signature is already set // Factory-created transactions need manual signing const tx = await factory.createTransactionForTransfer(sender, options); tx.nonce = account.getNonceThenIncrement(); tx.signature = await account.signTransaction(tx); ``` ## Message Signing ```typescript // Sign arbitrary message const message = new SignableMessage({ message: Buffer.from("Hello") }); const signature = await account.signMessage(message); // Verify signature import { MessageSigner } from "@multiversx/sdk-core"; const isValid = MessageSigner.verify(message, signature, publicKey); ``` ## Ledger Device ```typescript // Ledger requires MultiversX app installed import { LedgerAccount } from "@multiversx/sdk-hw-provider"; const ledger = new LedgerAccount(); await ledger.init(); const address = await ledger.getAddress(0); ``` ## Security Best Practices | Practice | Reason | |----------|--------| | Use keystore files | Encrypted with password | | Never commit PEM files | Plain text private keys | | Use Ledger for mainnet | Hardware security | | Validate addresses | Prevent typos | # SDK JS Tokens --- name: mvx_sdk_js_tokens description: Token operations (ESDT/NFT/SFT) for MultiversX TypeScript/JavaScript SDK. --- # MultiversX SDK-JS Token Operations This skill covers ESDT (fungible), NFT, and SFT token operations. ## Token Transfers ### Native EGLD Transfer ```typescript const controller = entrypoint.createTransfersController(); const tx = await controller.createTransactionForTransfer(account, nonce, { receiver: Address.newFromBech32("erd1..."), nativeAmount: 1000000000000000000n // 1 EGLD (18 decimals) }); ``` ### ESDT Token Transfer ```typescript import { TokenTransfer } from "@multiversx/sdk-core"; const tx = await controller.createTransactionForTransfer(account, nonce, { receiver: receiverAddress, tokenTransfers: [ TokenTransfer.fungibleFromBigInteger("TOKEN-abc123", 1000000n) ] }); ``` ### NFT/SFT Transfer ```typescript const tx = await controller.createTransactionForTransfer(account, nonce, { receiver: receiverAddress, tokenTransfers: [ TokenTransfer.nftFromBigInteger("NFT-abc123", 1n, 1n) // nonce=1, quantity=1 ] }); ``` ## Token Issuance ### Issue Fungible Token ```typescript const controller = entrypoint.createTokenManagementController(); const tx = await controller.createTransactionForIssuingFungible(account, nonce, { tokenName: "MyToken", tokenTicker: "MTK", initialSupply: 1_000_000_000000n, // With decimals numDecimals: 6n, canFreeze: false, canWipe: true, canPause: false, canChangeOwner: true, canUpgrade: true, canAddSpecialRoles: true }); const txHash = await entrypoint.sendTransaction(tx); const outcome = await controller.awaitCompletedIssueFungible(txHash); const tokenIdentifier = outcome[0].tokenIdentifier; ``` ### Issue Semi-Fungible Token ```typescript const tx = await controller.createTransactionForIssuingSemiFungible(account, nonce, { tokenName: "MySFT", tokenTicker: "SFT", canFreeze: false, canWipe: true, canPause: false, canTransferNFTCreateRole: true, canChangeOwner: true, canUpgrade: true, canAddSpecialRoles: true }); ``` ### Register and Set NFT Roles ```typescript const tx = await controller.createTransactionForRegisteringAndSettingRoles(account, nonce, { tokenName: "MyNFT", tokenTicker: "MNFT", tokenType: "NonFungibleESDT" }); ``` ## Token Role Management ```typescript // Set special role const tx = await controller.createTransactionForSettingSpecialRole(account, nonce, { tokenIdentifier: "TOKEN-abc123", user: userAddress, addRoleLocalMint: true, addRoleLocalBurn: true }); ``` ## Token Queries ```typescript const provider = entrypoint.createNetworkProvider(); // Get specific token const token = await provider.getTokenOfAccount(address, "TOKEN-abc123"); // Get all fungible tokens const tokens = await provider.getFungibleTokensOfAccount(address); // Get all NFTs const nfts = await provider.getNonFungibleTokensOfAccount(address); ``` ## Best Practices 1. **Decimals**: EGLD has 18 decimals, custom tokens vary 2. **Token identifiers**: Format is `TICKER-hexhash` (e.g., `USDC-a1b2c3`) 3. **NFT nonces**: Start at 1, increment per mint 4. **Gas**: Token operations need ~60,000,000+ gas # SDK JS Contracts --- name: mvx_sdk_js_contracts description: Smart contract operations for MultiversX TypeScript/JavaScript SDK. --- # MultiversX SDK-JS Smart Contract Operations This skill covers ABI loading, deployments, calls, queries, and parsing. ## ABI Loading ```typescript import { Abi } from "@multiversx/sdk-core"; import { promises } from "fs"; // From file const abiJson = await promises.readFile("contract.abi.json", "utf8"); const abi = Abi.create(JSON.parse(abiJson)); // From URL const response = await axios.get("https://example.com/contract.abi.json"); const abi = Abi.create(response.data); // Manual construction const abi = Abi.create({ endpoints: [{ name: "add", inputs: [{ type: "BigUint" }], outputs: [{ type: "BigUint" }] }] }); ``` ## Smart Contract Controller ```typescript const controller = entrypoint.createSmartContractController(abi); ``` ## Deployment ```typescript const bytecode = await promises.readFile("contract.wasm"); const tx = await controller.createTransactionForDeploy(account, nonce, { bytecode: bytecode, gasLimit: 60_000_000n, arguments: [42] // Constructor args (plain values with ABI) }); const txHash = await entrypoint.sendTransaction(tx); const outcome = await controller.awaitCompletedDeploy(txHash); const contractAddress = outcome[0].contractAddress; ``` ## Contract Calls ```typescript // With ABI - use plain values const tx = await controller.createTransactionForExecute(account, nonce, { contract: contractAddress, function: "add", arguments: [42], gasLimit: 5_000_000n }); // Without ABI - use TypedValue import { U32Value, BigUintValue } from "@multiversx/sdk-core"; const tx = await controller.createTransactionForExecute(account, nonce, { contract: contractAddress, function: "add", arguments: [new U32Value(42)], gasLimit: 5_000_000n }); ``` ## Transfer & Execute (Send tokens to SC) ```typescript const tx = await controller.createTransactionForExecute(account, nonce, { contract: contractAddress, function: "deposit", arguments: [], gasLimit: 10_000_000n, nativeTransferAmount: 1_000_000_000_000_000_000n, // 1 EGLD tokenTransfers: [ TokenTransfer.fungibleFromBigInteger("TOKEN-abc123", 1000n) ] }); ``` ## VM Queries (Read-Only) ```typescript const controller = entrypoint.createSmartContractController(abi); const result = await controller.queryContract({ contract: contractAddress, function: "getSum", arguments: [] }); // Parsed output (with ABI) const sum = result[0]; // Automatically typed ``` ## Upgrades ```typescript const newBytecode = await promises.readFile("contract_v2.wasm"); const tx = await controller.createTransactionForUpgrade(account, nonce, { contract: contractAddress, bytecode: newBytecode, gasLimit: 60_000_000n, arguments: [] }); ``` ## RelayedV3 Contract Calls ```typescript const tx = await controller.createTransactionForExecute(account, nonce, { contract: contractAddress, function: "endpoint", arguments: [], gasLimit: 5_050_000n, // +50,000 for relayed relayer: relayerAddress }); tx.relayerSignature = await relayer.signTransaction(tx); ``` ## Best Practices 1. **Always use ABI** when available for type safety 2. **Gas estimation**: Start high, optimize later 3. **Simulate first**: Use `simulateTransaction()` before real calls 4. **Parse outcomes**: Use `awaitCompletedExecute()` for return values

Your Transactions