Is ONEwallet+ Extension safe?

Medium risk

CROSSx lets any HTTPS page switch the wallet's active chain through its injected page bridge.

CROSSx injects a bridge into every HTTPS page at page start and relays same-window crossWallet request messages to its background worker without checking the page origin. A page can send wallet_switchEthereumChain to change the wallet's stored active chain and trigger a chain-change broadcast, without a connected account or approval prompt.

NEXUS Co., Ltd.v1.9.0Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

ARA chat feature sends your wallet address and question to a third-party webhook

Asking the wallet's ARA AI assistant a question sends your question text and wallet address to a workflow-automation webhook on n8n.cloud, not the vendor's own crosstoken.io backend, using a token shared by every install.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You type a question into the wallet's ARA AI assistant and submit it.

This includes ordinary questions like asking about your balance.

The extension did this

The extension sends your question and connected wallet address to a third-party automation webhook.

The request goes to n8n.cloud, not the vendor's own crosstoken.io API used everywhere else in the extension.

Captured request
POSThttps://tonexus.app.n8n.cloud/webhook/ara

200 OK; server streamed an SSE-style chat reply back to the extension.

Headers
Content-Type
application/json
Authorization
Bearer <redacted>
Body
{  "chatId": "<session-id>",  "question": "<planted marker value>",  "requestType": "com.nexus.crosswallet.desktop",  "walletAddress": "0x95d23B15932A876001c2dF4cf0b76e255cF9465a",  "locale": "en-US"}
The code that does this

ARA chat posts to n8n.cloud with a token shared by every install

Readable version

assets/ara-DWvoOYDV.js: the ARA POST call

assets/ara-DWvoOYDV.js
const Pv = "<redacted>";const v = ve.useCallback(async M => {  const D = wo.API_URL.ARA_API;  await Dv({    baseUrl: D,    bearerToken: Pv,    body: {      chatId: await Yi.get("chatId"),      question: M ?? "",      requestType: "com.nexus.crosswallet.desktop",      walletAddress: m?.address ?? "",      locale: navigator.language || navigator.languages?.[0] || "en-US"    },    signal: z.signal  }, { ... })}, [m?.address]);

assets/main-ByV4Ptmw.js: ARA_API points at n8n.cloud, not crosstoken.io

assets/main-ByV4Ptmw.js
ARA_API: {  DEVELOPMENT: "https://tonexus.app.n8n.cloud/webhook/dev-ara",  STAGING: "https://tonexus.app.n8n.cloud/webhook/ara",  PRODUCTION: "https://tonexus.app.n8n.cloud/webhook/ara"}
Where ARA chat data ends up, compared to the rest of the wallet
    • tonexus.app.n8n.cloud

    Receives your ARA question and wallet address; an n8n.cloud-hosted workflow-automation endpoint, not a domain the vendor operates directly.

    • bridge-api.crosstoken.io

    The vendor's own backend, used by every other feature in the wallet except ARA chat.

Updated 30 September 2026nninbdadmocnokibpaaohnoepbnpdgcg