In routes/deals.js around line 11, the POST handler receives the buyer's private key directly in the request body:
const { buyerSecret, seller, amount, description } = req.body;
const buyerPublic = StellarSdk.Keypair.fromSecret(buyerSecret).publicKey();
const txHash = await lockFunds(buyerSecret, ESCROW_PUBLIC, amount, deal.id);The server sees the full secret key, can log it, and can use it to drain the buyer's entire wallet at any time. Any attacker who compromises the server, intercepts traffic, or reads request logs gets access to every buyer's private key.
This is critical. Transaction signing needs to happen client-side. The server should receive a signed XDR envelope, not the secret key. The frontend should build and sign the transaction locally using the Stellar SDK, then send only the signed transaction to the server for submission or verification.
This affects the entire escrow flow in src/routes/deals.js and src/services/escrow.js.
Before submitting your PR, make sure all checks pass locally and the build succeeds. Each issue will be thoroughly reviewed and only merged if it fully meets the requirements. In your PR, specify the issue number and title. You can optionally provide a screenshot showing the fix working. On the issue, comment tagging the author to let them know you're working on it. On the PR, tag the maintainer to notify that review is ready.
In routes/deals.js around line 11, the POST handler receives the buyer's private key directly in the request body:
The server sees the full secret key, can log it, and can use it to drain the buyer's entire wallet at any time. Any attacker who compromises the server, intercepts traffic, or reads request logs gets access to every buyer's private key.
This is critical. Transaction signing needs to happen client-side. The server should receive a signed XDR envelope, not the secret key. The frontend should build and sign the transaction locally using the Stellar SDK, then send only the signed transaction to the server for submission or verification.
This affects the entire escrow flow in src/routes/deals.js and src/services/escrow.js.
Before submitting your PR, make sure all checks pass locally and the build succeeds. Each issue will be thoroughly reviewed and only merged if it fully meets the requirements. In your PR, specify the issue number and title. You can optionally provide a screenshot showing the fix working. On the issue, comment tagging the author to let them know you're working on it. On the PR, tag the maintainer to notify that review is ready.