GiftedHacker/tangem-app-android-audited
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

Updated on 2026-08-14

Browse source
This commit is contained in:
Tangem 2026-07-13 15:53:16 +04:00
parent 7c1bfc2c7c
commit f35975398d
5 changed files with 60 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

8
features/send/impl/src/main/java/com/tangem/features/send/deeplink/DefaultSellRedirectDeepLinkHandler.kt
View file

@ -57,9 +57,11 @@ internal class DefaultSellRedirectDeepLinkHandler @AssistedInject constructor(
scope.launch {
// Only trust the redirect if it carries a request_id we issued for a sell this
// app actually started (single-use, bound to the wallet + currency). Otherwise an external
// deeplink could inject a locked attacker recipient/amount into the Send confirm screen.
val pendingOfframp = offrampRepository.consumePendingOfframp(
// app actually started (bound to the wallet + currency, valid until it expires). Otherwise an
// external deeplink could inject a locked attacker recipient/amount into the Send confirm
// screen. The record is kept until expiry so the user can re-open the redirect within that
// window.
val pendingOfframp = offrampRepository.resolvePendingOfframp(
requestId = requestId,
userWalletId = userWallet.walletId,
currencyId = currencyId,