Difficulty: Advanced
Type: security
Background
Member management includes wallet info per the README's feature list, and wallet addresses are sensitive, easily-mistyped identifiers that are commonly mishandled in dashboards (full exposure, no checksum validation, easy-to-fumble copy actions).
Problem
Wallet addresses are likely rendered as raw full strings with no checksum/format validation on input, no safe copy-to-clipboard affordance, and no truncation/obfuscation strategy, increasing risk of shoulder-surfing exposure and admin data-entry errors (e.g., adding a malformed address for a member).
Expected outcome
Wallet addresses are validated on input (correct format/checksum for the supported chain), displayed truncated by default (e.g., 0x1234…abcd) with a full-reveal and copy-to-clipboard action, and any wallet-related admin action requires an explicit confirmation step.
Suggested implementation
- Add address format/checksum validation (e.g., EIP-55 for EVM addresses) to the member creation/edit form using a small utility in
packages/integration-client.
- Build a reusable
WalletAddress display component: truncates by default, expand-on-click, copy-to-clipboard with a success toast, and a link-out to a block explorer.
- Add a confirmation dialog for destructive/sensitive wallet-linked actions (e.g., changing a member's linked wallet).
- Add tests for the validation utility covering valid/invalid/edge-case addresses.
Acceptance criteria
Likely affected files/directories
apps/dashboard/app/members/
apps/dashboard/components/ (new WalletAddress component)
packages/integration-client/
Difficulty: Advanced
Type: security
Background
Member management includes wallet info per the README's feature list, and wallet addresses are sensitive, easily-mistyped identifiers that are commonly mishandled in dashboards (full exposure, no checksum validation, easy-to-fumble copy actions).
Problem
Wallet addresses are likely rendered as raw full strings with no checksum/format validation on input, no safe copy-to-clipboard affordance, and no truncation/obfuscation strategy, increasing risk of shoulder-surfing exposure and admin data-entry errors (e.g., adding a malformed address for a member).
Expected outcome
Wallet addresses are validated on input (correct format/checksum for the supported chain), displayed truncated by default (e.g.,
0x1234…abcd) with a full-reveal and copy-to-clipboard action, and any wallet-related admin action requires an explicit confirmation step.Suggested implementation
packages/integration-client.WalletAddressdisplay component: truncates by default, expand-on-click, copy-to-clipboard with a success toast, and a link-out to a block explorer.Acceptance criteria
Likely affected files/directories
apps/dashboard/app/members/apps/dashboard/components/(new WalletAddress component)packages/integration-client/