JavaScript
JavaScript security review
JavaScript is what most wallets and dapp frontends — web apps that talk to a blockchain — are written in. Hackerbane audits the JavaScript that can sign a transaction or hold a key.
scope
What we review
We audit wallets, dapp pages, scripts, and Node services that hold keys or send transactions. Typical issues are prototype pollution, XSS that reaches the signer, a dependency you did not mean to install, and an RPC reply the code trusts without checking.
Prototype pollution through object merges, defaults, or query parsing that later reaches a signer.
XSS on a dapp or wallet page that can call the injected provider or trigger a sign.
Supply-chain and bundler paths that swap a provider or a lockfile entry after install.
RPC results treated as fact: chain id, balances, receipts, and return data.
Node scripts and services that keep a private key in process and send transactions from untrusted input.
Advanced Threat Detection
We built our own advanced threat detection stack that is more performant and cheaper than our competitors. We use a state-of-the-art AI harness coupled with world-class senior security engineers with proven experience finding vulnerabilities in well-tested software.
How we review this language
A JavaScript review follows the same five-stage engagement as every Hackerbane audit. We look at the page, the extension, the script, and any Node service that can reach a key or a signer.
Two senior engineers read the code in parallel. We try hostile pages, polluted objects, and a lying RPC, and we check that what the user approved is what actually gets signed.
Scope and threat model
We lock the repo, the commit, and the surfaces a user touches: the popup, the injected provider, the session store, and the signer, before the review starts.
Architecture and design review
We trace every path from a click or an injected message to a signed payload, and check that what the user approves is what actually gets signed.
Hybrid code and infrastructure review
Two senior engineers read the JavaScript in parallel, with the bundler output, node, and tests that drive the wallet with hostile pages and messages.
Exploitability and root-cause analysis
High and Critical findings ship with a runnable proof in a page or an extension and the root cause, so the class of bug is closed, not one instance.
Reporting and remediation
A prioritized report, a live walkthrough, and verification of every in-scope fix within the remediation window.
Tools and practices
We work in the repository you already use. The package manager, the bundler, Node, and your test runner stay in place. We add tests and proofs, then hand those artifacts back with the report.
What you get
Prioritized findings your engineers can ship against, each with root cause and a recommended fix.
Runnable proofs of concept for High and Critical issues, in a page, an extension, or a Node script.
A report you can share with partners, investors, and counterparties.
Remediation verification and a final report that reflects the fixed state of the system.
The page, pollution, and RPC tests used during the review.
How to prepare
| # | Before review starts |
|---|---|
| 01 | The app builds and tests run cleanly from a fresh checkout. |
| 02 | The code is stable, with no major refactors planned mid-audit. |
| 03 | Wallets, pages, scripts, and Node services that can sign or send are documented. |
| 04 | Origin, RPC, and dependency trust assumptions are written down. |
| 05 | Scope is defined: which app, extension, or service, which commit, and which build. |
Other pages
Questions
- Is the frontend really in scope?
- If a user can lose funds from a page or an extension, that JavaScript is part of the system. We review it next to the APIs and contracts it calls.
- Do you review Node scripts and services?
- Yes, when they hold a key, build a transaction, or broadcast one. A deploy script with a funded signer is in the same class as a wallet.
- What about the contracts the dapp calls?
- When the JavaScript signs against a contract we can review both in one engagement, so the click and the on-chain call are both covered.
Next step
Request an audit
Share the repo, which wallets, pages, scripts, or Node services can sign or send, and your timeline. We will propose an audit plan and estimate.