Thread by @SarahJamieLewis

What a helpful note that is totally indicative of software that is well designed and will likely have no security issues.

It's a public holiday and I'm trying very hard not to go diving into this code.

Seriously....

They have it covered though.

It is 2019, this is not how you design secure usable interfaces. In my opinion, the entire project should be rejected on that premise alone.

This isn't some php web app. The standards for implementing this kind of cryptography should be ridiculously high.

It is your job to prove the code secure, not just in theory, but in practice.

There are mechanisms for preventing entire classes of attacks / errors that would make comments like in the above code not necessary. The fact that such comments are necessary is a red flag.

https://twitter.com/hdevalence/status/1097559484375785472

And this is the point I want to get across. Someone could sit down and go through all the thousands of lines of proof code, in every file, across every integration flow and find no issue - and this code would still be bad.

Also, based on what I have charged for security reviews before, contracts I've reviewed & signed off on in industry, and what I know about the code base so far - such a review would be very, very expensive - way more than the bounty.