Bug Description
decryptKeystore in src/lib/actions/BaseAction.ts (lines 65-79)
has three issues combined.
Issue 1: Dead Code (Unreachable line 78)
When attempt >= MAX_PASSWORD_ATTEMPTS, failSpinner calls
process.exit(1). The recursive call after it is unreachable.
Issue 2: Potential Infinite Recursion
If failSpinner is ever called with shouldExit=false,
the recursion continues indefinitely — no return or throw exists
after failSpinner.
Issue 3: Wrong Error Classification
The catch block catches ALL errors from fromEncryptedJson
(malformed JSON, crypto errors, corrupted keystore) and treats
them all as wrong password. Users with corrupted keystores
get prompted 3 times with "Invalid password" before a
misleading "Maximum attempts exceeded" error.
Suggested Fix
}catch(error: any){constisPasswordError=error.message?.includes('password')||error.message?.includes('decrypt');if(!isPasswordError)throwerror;// re-throw non-password errorsif(attempt>=BaseAction.MAX_PASSWORD_ATTEMPTS){this.failSpinner(`Maximum password attempts exceeded.`);return;// explicit return after failSpinner}returnawaitthis.decryptKeystore(keystoreJson,attempt+1);}File
src/lib/actions/BaseAction.ts lines 65-79
Severity: High
Already reported: No
Bug Description
decryptKeystoreinsrc/lib/actions/BaseAction.ts(lines 65-79)has three issues combined.
Issue 1: Dead Code (Unreachable line 78)
When
attempt >= MAX_PASSWORD_ATTEMPTS,failSpinnercallsprocess.exit(1). The recursive call after it is unreachable.Issue 2: Potential Infinite Recursion
If
failSpinneris ever called withshouldExit=false,the recursion continues indefinitely — no return or throw exists
after
failSpinner.Issue 3: Wrong Error Classification
The catch block catches ALL errors from
fromEncryptedJson(malformed JSON, crypto errors, corrupted keystore) and treats
them all as wrong password. Users with corrupted keystores
get prompted 3 times with "Invalid password" before a
misleading "Maximum attempts exceeded" error.
Suggested Fix
File
src/lib/actions/BaseAction.tslines 65-79Severity: High
Already reported: No