Is MultiversX Wallet safe?
MultiversX Wallet is medium risk. MultiversX Wallet fetches a domain block-list from extras-api.elrond.com every 10 min and replaces matching pages' HTML with a block overlay. Unsigned, so a compromised endpoint or MITM could blank sites. On by default on all HTTP/HTTPS.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Unsigned Remote Deny-List Controls Full-Page Replacement on All Sites
MultiversX Wallet fetches a domain block-list from extras-api.elrond.com every 10 min and replaces matching pages' HTML with a block overlay.
Unsigned, so a compromised endpoint or MITM could blank sites.
On by default on all HTTP/HTTPS.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You navigate to any website while the extension is installed and site-blocking is enabled (the default).
Fetches an unsigned deny-list from extras-api.elrond.com; if the current site's origin substring-matches any key, replaces the entire page with a block overlay.
JSON object mapping domain substrings to block metadata. No Content-Signature, Digest, or other integrity header is present in the response.
Background: deny-list fetch (no integrity check)
async getScamBlockWebsites() { let domainList; const cached = await this.getWithExpiry('scamWebsites'); if (cached) { domainList = JSON.parse(cached); } else { // No SRI check, no signature verification const resp = await fetch('https://extras-api.elrond.com/permissions/deny/domains'); domainList = await resp.json(); // Cache for 10 minutes (600,000 ms) await this.setWithExpiry('scamWebsites', JSON.stringify(domainList), 600000); } return domainList;}Content script: substring match triggers full-page replacement
// Iterate every key in the remote deny-listfor (const domainKey in domainList) { // Substring match — a single-char key would match every origin if (location.origin.indexOf(domainKey) !== -1) { document.addEventListener('DOMContentLoaded', async function () { // Remove all <script> elements from the page document.querySelectorAll('script').forEach(s => s.parentNode?.removeChild(s)); // Blank the entire page document.getElementsByTagName('html')[0].innerHTML = ''; // Inject fixed overlay const overlay = document.createElement('div'); overlay.innerHTML = '<html>...<title>MultiversX DeFi Alert</title>...</html>'; overlay.style.cssText = 'position:fixed;top:0;width:100vw;height:100vh;z-index:1001;...'; document.body.appendChild(overlay); }); }}- extras-api.elrond.com
MultiversX (formerly Elrond) API server supplying the deny-list JSON. A compromise or MITM could inject domain keys, blanking matching sites for all users.
What it can do
Permissions this extension asks for, as declared in version 2.1.13. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Read whatever you have copied to your clipboard
clipboardRead
Show a panel beside the page
sidePanel