Beldex

We express our gratitude to the Beldex team for the collaborative engagement that enabled the execution of this dApp Security Assessment.

This report presents the results of an independent source-code security assessment of the Beldex wallet browser extension and the bdx-web3js integration SDK.

The assessment focused on security-critical runtime paths connecting web applications, the injected provider, the content script, the extension background worker, approval interfaces, wallet sessions, transaction construction, message signing, BNS resolution, and light-wallet-server communication.

The review was performed against immutable repository commits supplied for the engagement. Static analysis was supplemented with repository-native builds, type checks, unit and integration tests, deterministic concurrency models, payload-boundary testing, and targeted cryptographic verification.

The system users should acknowledge all the risks summed up in the risks section of the report

{FindingsVulnSeverityStatusTable}

Documentation quality

• The repositories provide useful top-level documentation, setup instructions, architecture descriptions, protocol guidance, integration examples, known limitations, and test coverage. The SDK documentation explains provider discovery, wallet connection, message signing, BNS resolution, events, and error handling.

• Some documentation and type declarations have drifted from the implementation. Examples include implemented methods described as unavailable, differences between public response behavior and documented schemas, outdated build guidance, and security statements that require more precise threat-model wording.

• Documentation should be maintained as a versioned interface contract and updated in the same change as protocol, build, dependency, permission, browser-support, or security behavior changes.

Code quality

• The codebase is generally modular and uses TypeScript types to separate protocol messages, wallet state, network clients, approval interfaces, cryptographic helpers, and SDK-facing APIs. Security-sensitive operations are usually isolated into named modules, and the reviewed projects include meaningful automated tests.

• The principal code-quality concern is that related security state is distributed across in-memory maps, browser storage, timers, runtime ports, approval windows, and current wallet-session lookups. Individual checks are often reasonable, but some multi-step operations are not represented by one atomic state transition.

• Input validation is present for methods and several fields, but it is not consistently accompanied by byte, depth, key-count, or total-complexity limits before untrusted data crosses browser-process boundaries.

The reviewed system consists of a browser wallet extension and a TypeScript SDK used by web applications.

DAPP REQUEST PATH

WALLET EXTENSION

• The background worker manages wallet metadata, active-wallet state, encrypted vault access, unlocked sessions, auto-lock behavior, dApp grants, pending approvals, events, synchronization, and privileged extension messages.

• The content script validates the outer dApp request envelope and relays accepted requests between the page and the extension runtime port.

• The injected provider exposes the page-facing wallet API and communicates through same-window messages. It does not directly receive extension secrets or browser extension privileges.

• The popup, side panel, and standalone approval interfaces display connection, transaction, and message-signing requests and obtain current wallet secrets through privileged background messages when execution is approved.

• Transaction construction is performed through the pinned Beldex application bridge and WebAssembly interface. Light-wallet-server endpoints provide account information, unspent outputs, transaction submission, and synchronization data.

• The message-signing implementation uses local spend-key material, Noble curve primitives, Keccak hashing, and a SigV1-compatible encoding. Public verification extracts a spend public key from a supplied address and verifies the submitted transcript.

BDX-WEB3JS SDK

The SDK provides wallet discovery, provider transport, connection management, balance and network queries, transaction requests, message signing and verification, BNS resolution, event subscriptions, React integration, unit conversion, address-shape helpers, timeout handling, and normalized errors.

TRUST BOUNDARIES

• Web pages and all page-supplied request data are untrusted.

• Origins used for wallet authorization are derived from browser sender metadata rather than request parameters.

• Ordinary web content cannot directly invoke privileged extension-page message handlers.

• Wallet secrets are retained inside extension-controlled contexts and are not intentionally returned to dApps.

• The configured BNS resolver is an intended trust anchor according to client clarification.

• The configured light-wallet server receives the wallet address and private view key and is trusted for scanning data and transaction relay, but it does not receive the private spend key.

• The native and WebAssembly bridge is a security-critical dependency for address handling and transaction construction.

SECURITY STRENGTHS OBSERVED

• Browser-derived origin association for dApp runtime ports.

• Privileged message checks based on extension identity and extension-page URL.

• Connection grants associated with both origin and wallet identity.

• Explicit approval interfaces for connection, transaction, and signing requests.

• Private spend keys remain inside extension-controlled execution paths.

• Encrypted local wallet vault using authenticated encryption and a high-iteration password-based derivation function.

• Persisted unlock backoff intended to slow repeated online password attempts.

• Plain HTTP origins are rejected except for local development contexts.

• Content Security Policy and local extension assets reduce remote-code-loading exposure.

• Exact dependency pinning for the Beldex application bridge in the reviewed lockfile.

• Message signing performs key-pair validation and a local signature self-check before returning a signature.

• Transaction approvals display destination, amount, fee information, and other transaction facts before execution.

• BNS payment review displays the complete resolved address for user confirmation.

TESTING AND VALIDATION

EXACT SOURCE VALIDATION

Both repositories were checked out at the full reviewed commit hashes. Security-relevant report snippets were compared with the immutable source and annotated with repository-relative file paths and exact line ranges.

WALLET EXTENSION

• 31 repository-native tests passed.

• The TypeScript check passed.

• The Chromium production build passed.

• The Firefox production build passed.

• SDK

• 70 repository-native tests passed.

• The TypeScript check passed.

• ESM, CommonJS, IIFE, and declaration builds passed.

The scope of the project includes the following codebase from the provided repository: