- Executive summary of findings including 1 High, 4 Medium, 3 Low, and 1 Informational issues.
- Detailed descriptions and recommendations for each finding, including critical issues related to multi-tab wallet persistence, password management, and WalletConnect vulnerabilities.
- Re-verification of prior findings with updated statuses and evidence.
- Dependency review highlighting new advisories and potential security impacts.
- Appendix listing files reviewed during the audit process.

* Add Biatec Direct: relay-free popup + postMessage dApp transport (#192)

A third dApp transport next to WalletConnect and Liquid Auth. The dApp opens
/direct in a popup and exchanges ARC-0027 messages over window.postMessage;
nothing passes through a relay or the internet, so it works for localhost dApps
and offline installs.

Security: the dApp identity is the browser-verified event.origin (https or
loopback only), every message must come from both the hinted origin and
window.opener, replies use that origin as targetOrigin (never "*"), exactly one
request per popup within 30 s of ready, refuses to run framed or without an
opener, network-binds every request and transaction to the active genesis hash,
and reuses the shared sender/signer admission guards. Site grants live in the
encrypted wallet blob and are written with a read-modify-write against the
persisted record so a stale tab cannot overwrite another tab's data.

Also: Connect page "Direct" tab (list/revoke sites), frame-ancestors CSP in the
nginx config, connect.direct.* strings in all 10 locales, docs/DIRECT.md,
changelog, unit tests and a Playwright E2E spec using a cross-origin fixture dApp.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Address review findings on Biatec Direct (wallet side)

- Stale tab: saveWallet now takes the persisted value of shared wc items
  (direct:sessions) and wallet-record writes are serialized across tabs with a
  Web Lock, so a stale main tab can neither restore a revoked grant nor drop a
  new one.
- Single-use channel: a reload or lock/unlock cycle never announces ready again.
- handleRequest answers 4000 and ends the request on unexpected failure; the
  popup shows a "refused" state; approve/send/cancel responses are idempotent.
- The built-in table of well-known networks wins over the remote genesis list;
  grants are bound to the network they were made on; sign_data validates an
  optional genesisHash.
- Reject trailing-dot origins; /payWC inside a popup uses the minimal layout.
- Document the wire contract (wallet providerId, normalized genesisHash).
- Tests: wire-shape contract, stale-tab regression, disable, reload replay,
  ARC-60 unapproved signer / domain mismatch / approved signer, poisoned list.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Address second-round review findings on Biatec Direct (wallet side)

- approveEnable restores the pending request when persisting the grant fails,
  so the popup can retry or reject instead of going blank.
- Connect page: a Direct-tab load failure no longer aborts the page init.
- startPopup load failure shows the "start over" state rather than "refused".
- changePassword takes the cross-tab wallet write lock and keeps shared items
  persisted by other tabs (shared serializer with saveWallet).
- Document the dApp-implementer rules (unique window name, accepted origins).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Address third-round review findings on Biatec Direct (wallet side)

- Grant updates are now one atomic critical section: wallet/wcUpdateItemFresh
  runs read, update and write inside the cross-tab Web Lock, so concurrent
  updates (popup approve vs main-tab revoke) can neither restore a revoked
  grant nor drop a new one. The shared-item merge is a pure, unit-tested module.
- direct/reset runs first and in its own try/catch on logout and wallet
  destruction, so a pending request is always answered 4001 even if another
  transport's teardown throws.
- Only the four known peer fields are persisted (no dApp-controlled extra keys).
- A refused second channel start no longer tears down the live channel.
- Tests: merge unit spec, concurrent-update atomicity and lock-mid-request E2E.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Address fourth-round review findings on Biatec Direct (wallet side)

- Never wait on the remote genesis list for well-known networks or custom nodes
  (a stalled connection to the list host could leave the popup waiting).
- Docs name the right shared-item action (wcUpdateItemFresh).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Cap account names sent in the Direct enable response

The dApp library rejects names longer than 128 characters, which would make a
valid grant fail on the dApp side while the wallet kept it. Bound the name at
the source and omit it when empty.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Accept the verified origin's host (with port) as the ARC-0060 domain

use-wallet sends location.host as the ARC-0060 domain, which includes a
non-default port ("localhost:5173"); the wallet compared only the hostname, so
sign_data was refused for any dApp on a non-default port, including the
documented localhost development case. Accept the origin's host or hostname
(another host or port is still refused). The check moves to an import-free
module with a unit spec; an E2E test signs a port-bearing domain.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Direct popup: privacy and UX pass

Security/privacy: the enable response carries addresses only. Account names
are the user's private labels and were sent to the site without saying so.

UX: the popup now leads with a request headline and a prominent, scheme-aware
origin card; the network is shown by its friendly name; the locked screen
already names the site asking for access (from the URL hint); the window title
names the site; the signing view is compact (no bookkeeping columns or paging,
transactions expanded) and the result returns to the site automatically once
everything in the request is signed, so a second click in a small window is
not needed; clearer waiting/empty states and button hierarchy.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Direct popup: fit the signing view into the popup

The shared request table was designed for desktop and overflowed the 480px
window, clipping the primary button and the transaction columns. In the popup
it now hides the bookkeeping columns, the header rows and the developer copy
button, keeps the type and rekey/close-to warnings, labels the fee, shows
"Send back" only for a partially signed request, and wraps values without
breaking the detail labels.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Direct popup: review fixes for sign-data review, origin wording, fee detail

- Sign-data in the popup: items are expanded and reviewed individually; the
  one-click "Sign all" is not offered there (a result now returns on its own
  once every item is signed, so nothing may be signed unseen).
- The site address is labelled "claimed, not confirmed" until a message from
  it has been accepted; the pre-unlock banner says "a page claiming to be ...".
- The per-transaction fee is a row in the detail view (all transports), so it
  is never hidden behind the request total.
- E2E: sign-data review/auto-return, rekey and fee visible in the compact view,
  a partly signed request is not returned automatically.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Direct popup: show clawback source and OnComplete; polish states and a11y

Security/trust: the request detail now lists the account an asset clawback
really takes funds from and an app call's OnComplete (destructive ones are
highlighted), for every transport, since the compact popup is the only review
surface. The pre-unlock banner and window title only use the unverified origin
hint in a genuine popup (opener present, not framed). A custom node shows that
the site chooses the network, with the start of the genesis hash.

UX: rejecting shows a neutral "Request declined" state instead of a green
"Done"; single-transaction requests show one Sign button; the hidden expander
column no longer wastes popup width; state changes move focus to the headline
and are announced; the kicker names the wallet brand; the sign hint is accurate
for multi-step requests; Hungarian copy grammar fixed.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Direct: sign only what the popup can show completely; verified-state fixes

Security: the compact popup is the user's only review surface, so Direct now
signs only payments, asset transfers and calls to existing apps. Asset
configuration, freeze, key registration, state proofs, heartbeats and app
creation/update (whose security-relevant fields it does not show) are refused
with 4200; dApps needing them use WalletConnect.

Trust display: a popup-level "verified" flag (set once a message from the hinted
origin passed the gate) drives the "verified/claimed" label, so it no longer
reverts to "claimed" after a declined or refused request, and the window title
names the site only once it is verified. Removed the noisy aria-live region;
focus moves to the headline on each state change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Ludovit Scholtz <ludovit.scholtz@aaaauto.cz>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>