Is MultiversX Wallet safe?

Medium risk

MultiversX Wallet is medium risk. MultiversX Wallet fetches a domain block-list from extras-api.elrond.com every 10 min and replaces matching pages' HTML with a block overlay. Unsigned, so a compromised endpoint or MITM could blank sites. On by default on all HTTP/HTTPS.

MultiversXv2.1.13Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Unsigned Remote Deny-List Controls Full-Page Replacement on All Sites

MultiversX Wallet fetches a domain block-list from extras-api.elrond.com every 10 min and replaces matching pages' HTML with a block overlay.

Unsigned, so a compromised endpoint or MITM could blank sites.

On by default on all HTTP/HTTPS.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You navigate to any website while the extension is installed and site-blocking is enabled (the default).

The extension did this

Fetches an unsigned deny-list from extras-api.elrond.com; if the current site's origin substring-matches any key, replaces the entire page with a block overlay.

Captured request
GEThttps://extras-api.elrond.com/permissions/deny/domains

JSON object mapping domain substrings to block metadata. No Content-Signature, Digest, or other integrity header is present in the response.

The code that does this

Background: deny-list fetch (no integrity check)

Readable version
async getScamBlockWebsites() {  let domainList;  const cached = await this.getWithExpiry('scamWebsites');  if (cached) {    domainList = JSON.parse(cached);  } else {    // No SRI check, no signature verification    const resp = await fetch('https://extras-api.elrond.com/permissions/deny/domains');    domainList = await resp.json();    // Cache for 10 minutes (600,000 ms)    await this.setWithExpiry('scamWebsites', JSON.stringify(domainList), 600000);  }  return domainList;}
The code that does this

Content script: substring match triggers full-page replacement

Readable version
// Iterate every key in the remote deny-listfor (const domainKey in domainList) {  // Substring match — a single-char key would match every origin  if (location.origin.indexOf(domainKey) !== -1) {    document.addEventListener('DOMContentLoaded', async function () {      // Remove all <script> elements from the page      document.querySelectorAll('script').forEach(s => s.parentNode?.removeChild(s));      // Blank the entire page      document.getElementsByTagName('html')[0].innerHTML = '';      // Inject fixed overlay      const overlay = document.createElement('div');      overlay.innerHTML = '<html>...<title>MultiversX DeFi Alert</title>...</html>';      overlay.style.cssText = 'position:fixed;top:0;width:100vw;height:100vh;z-index:1001;...';      document.body.appendChild(overlay);    });  }}
Remote control endpoint
    • extras-api.elrond.com

    MultiversX (formerly Elrond) API server supplying the deny-list JSON. A compromise or MITM could inject domain keys, blanking matching sites for all users.

What it can do

Permissions this extension asks for, as declared in version 2.1.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Read whatever you have copied to your clipboard

    clipboardRead

  • Show a panel beside the page

    sidePanel

Updated 30 September 2026dngmlblcodfobpdpecaadgfbcggfjfnm