Halborn MetaMask “Demonic” Vulnerability Discovery

• Generate a unique secret recovery phrase

• Import the secret recovery phrase

• Wait at least 30 seconds to ensure the browser has time to record the session to disk

• Close the browser

The secret recovery phrase can then be found in the browser session data

The following are suggested mitigation measures that can be taken by wallet providers to avoid secret recovery phrases being stored in plain text both on-disk, and in system memory

• Split the Mnemonic Phrase input field into several fields (one per word) and ensure that only one is revealed at a time

• Instead of having the user enter their whole Phrase, use word selection for Mnemonic Phrase confirmation on wallet creation

• To speed up the garbage collector’s removal of the phrase from memory, clear or dereference values of variables which store Mnemonic Phrases in your code

• Avoid displaying the Mnemonic Phrase raw in the browser.

  • A way to do this is to display the Mnemonic in an HTML5 canvas, so that the browser does not load the whole Phrase in memory.

  • Another way is to obfuscate the Mnemonic Phrase as you display it. Each Mnemonic word could be displayed in a span HTML tag. In-between these spans there should be additional “fake” spans with “fake” random words. Each of the “fake” spans should have the following CSS properties: .fake{ position: absolute; left: 0px; top: 0px; z-index: -1; opacity: 0; } . This forces the browser to only display “genuine” Mnemonic words, while loading both the “genuine” and “fake” words into memory – thus obfuscating the Mnemonic Phrase.

• Prevent (and warn) users from directly copying/pasting the Mnemonic Phrase into the browser. The browser’s clipboard is also responsible for leaking data into memory. Therefore, it is important to warn the user not to fill the browser’s clipboard with the Mnemonic Phrase, and to prevent them from doing so using the following method:

  • Use the e.preventDefault() method on the onPaste event handler.

  • It is also important to warn the user to manually enter their Mnemonic Phrase word-by-word. Even by using the e.preventDefault() method, the user is still able to copy/paste their Mnemonic. The only difference when using the aforementioned method is that it will live in memory for a shorter period of time. It is better not to introduce it into memory at all.

  • During recovery of a wallet by entering the Mnemonic Phrase, it is suggested, instead of a text area, to provide to the users one password input for each mnemonic word.