Comswap.io

we did a deep-dive security analysis of the most popular $COMAI wallet comwallet.io/ we reveal and demonstrate serious security flaws that put users at risk, and make recommendations for users to improve their security. read the full report here: hackmd.io/@agic/comwalletio-… TLDR Key findings 1. In-App Seed Storage: Unlike standard practices that rely on secure browser extensions, comwallet.io stores the wallet's seed phrase within the application's own data storage. 2. Vulnerable to XSS Attacks: The seed phrase can be extracted by malicious scripts injected into the application, posing a significant security risk. 3. Potential for Unauthorized Access: The application owners or anyone with access to the codebase could potentially modify the application to extract users' seed phrases. Implications 1. Compromised Application Security: If comwallet.io's security is compromised, all users' seed phrases could potentially be exposed. 2. Trust Requirement: Users must implicitly trust the comwallet.io developers not to access or misuse their seed phrases. 3. Increased Attack Surface: Storing sensitive data within the application increases the potential attack surface for malicious actors. Given the security risks associated with comwallet.io's current implementation, How to secure your $COMAI Until comwallet has fixed these security flaws, we strongly recommend users to switch to alternative wallet solutions, like the official wallet.communeai.org that properly integrate with the standard secure Substrate wallet browser extensions like Polkadot{.js} or SubWallet. short wallet setup and use guide by @project_eden_ai youtu.be/IngNTd6CyZo?si=9KDT… By using these alternatives, users can significantly reduce the risk of their seed phrases being compromised through application-level vulnerabilities. 🫡