# \#gst-extension-wallet

**URL:** https://ghostforum.org/tag/gst-extension-wallet/35.md

[Latest](https://ghostforum.org/latest.md) · [Categories](https://ghostforum.org/categories.md) · [Tags](https://ghostforum.org/tags.md)

---

## [\[ghost-extension-wallet\] Sign-request popup renders blank on undecodable calldata; no error boundary](https://ghostforum.org/t/ghost-extension-wallet-sign-request-popup-renders-blank-on-undecodable-calldata-no-error-boundary/178)

<div class="topic-metadata">

**Author:** [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)\
**Replies:** 2\
**Last updated:** [October 13, 2026, 5:00am UTC](https://ghostforum.org/t/ghost-extension-wallet-sign-request-popup-renders-blank-on-undecodable-calldata-no-error-boundary/178 "2026-10-13T05:00:02Z")

</div>

Component: ghost-extension-wallet @ 66bd207, src/containers/WalletPopup/components/DecodedCallData.tsx:48,51, src/containers/WalletPopup/api/decodeCallData.ts. Description: decodeCallData returns undefined on any failur…

---

## [\[High\] Content script bridge trusts a spoofable origin field in sign requests](https://ghostforum.org/t/high-content-script-bridge-trusts-a-spoofable-origin-field-in-sign-requests/112)

<div class="topic-metadata">

**Author:** [@BYFOR](https://ghostforum.org/u/BYFOR)\
**Replies:** 4\
**Last updated:** [October 12, 2026, 2:41am UTC](https://ghostforum.org/t/high-content-script-bridge-trusts-a-spoofable-origin-field-in-sign-requests/112 "2026-10-12T02:41:43Z")

</div>

Severity: High Component: ghost-extension-wallet @ 66bd2077c7e82629eba7574466dd1cd94fac2bb9 (content/index.ts lines 17 to 25, background/createBackgroundRpc.ts lines 84 to 125 and 346 to 361, SignRequest.tsx lines 59 to …

---

## [No dapp connection authorization: any site can enumerate accounts and spam sign popups](https://ghostforum.org/t/no-dapp-connection-authorization-any-site-can-enumerate-accounts-and-spam-sign-popups/129)

<div class="topic-metadata">

**Author:** [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)\
**Replies:** 3\
**Last updated:** [October 11, 2026, 5:31pm UTC](https://ghostforum.org/t/no-dapp-connection-authorization-any-site-can-enumerate-accounts-and-spam-sign-popups/129 "2026-10-11T17:31:05Z")

</div>

Component: ghost-extension-wallet @ 66bd207, src/inpage/pjsInject.ts:22-24, src/background/createBackgroundRpc.ts:271-278. Description: The enable function in pjsInject.ts ignores origin entirely, with an explicit comme…

---

## [Extension derives the wrong scheme key for Ed25519 and ECDSA, the created account cannot sign at all](https://ghostforum.org/t/extension-derives-the-wrong-scheme-key-for-ed25519-and-ecdsa-the-created-account-cannot-sign-at-all/156)

<div class="topic-metadata">

**Author:** [@Sands](https://ghostforum.org/u/Sands)\
**Replies:** 3\
**Last updated:** [October 7, 2026, 12:52pm UTC](https://ghostforum.org/t/extension-derives-the-wrong-scheme-key-for-ed25519-and-ecdsa-the-created-account-cannot-sign-at-all/156 "2026-10-07T12:52:09Z")

</div>

Hi team Finding: for Ed25519 and ECDSA account creation, AddAccount stores the Sr25519-derived public key, but the exact getKeypair call the UI makes throws “Soft derivations are not supported”, because the shipped path…

---

## [Informational hardening notes batch (ghost-dao-interface, ghost-extension-wallet, ghost-lite)](https://ghostforum.org/t/informational-hardening-notes-batch-ghost-dao-interface-ghost-extension-wallet-ghost-lite/167)

<div class="topic-metadata">

**Author:** [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)\
**Replies:** 0\
**Last updated:** [October 7, 2026, 3:10am UTC](https://ghostforum.org/t/informational-hardening-notes-batch-ghost-dao-interface-ghost-extension-wallet-ghost-lite/167 "2026-10-07T03:10:00Z")

</div>

A batch of low-severity informational notes from the frontend and wallet audit. None of these is individually a vulnerability; they are grouped here for the team’s awareness. W6x-T1: Float math in tip computation (tip \*…

---

## [No auto-lock: unlock session lasts as long as the browser lives](https://ghostforum.org/t/no-auto-lock-unlock-session-lasts-as-long-as-the-browser-lives/148)

<div class="topic-metadata">

**Author:** [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)\
**Replies:** 1\
**Last updated:** [October 6, 2026, 9:29am UTC](https://ghostforum.org/t/no-auto-lock-unlock-session-lasts-as-long-as-the-browser-lives/148 "2026-10-06T09:29:45Z")

</div>

Component: ghost-extension-wallet @ 66bd207, src/background/keyring.ts:218-236 (let currentPassword: string | undefined), src/background/heartbeat.ts:18-35, assets/manifest-v3-chrome.json:9. Description: unlock() keeps c…