Is InsumerPass - Token & NFT Holder Discounts safe?

InsumerPass lets any webpage forge a fake wallet connection because its content-script message channel ID is exposed before use.

InsumerPass connects to MetaMask, Phantom, and Coinbase Wallet to check token and NFT holdings for checkout discounts. The extension is meant to only accept wallet-connection results from its own injected page script, but it writes the one-time channel ID used to verify that source into a readable HTML attribute before the check is wired up, so any script running on the same page can read it and send a forged "wallet connected" message with an attacker-chosen address. The extension then saves that forged address to its local storage and uses it to look up token/NFT balances for discount eligibility.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.