Skip to content

Harden wallet address display and handling across Members and Passes UIs #296

Description

@Lakes41

Difficulty: Advanced
Type: security

Background
Member management includes wallet info per the README's feature list, and wallet addresses are sensitive, easily-mistyped identifiers that are commonly mishandled in dashboards (full exposure, no checksum validation, easy-to-fumble copy actions).

Problem
Wallet addresses are likely rendered as raw full strings with no checksum/format validation on input, no safe copy-to-clipboard affordance, and no truncation/obfuscation strategy, increasing risk of shoulder-surfing exposure and admin data-entry errors (e.g., adding a malformed address for a member).

Expected outcome
Wallet addresses are validated on input (correct format/checksum for the supported chain), displayed truncated by default (e.g., 0x1234…abcd) with a full-reveal and copy-to-clipboard action, and any wallet-related admin action requires an explicit confirmation step.

Suggested implementation

  • Add address format/checksum validation (e.g., EIP-55 for EVM addresses) to the member creation/edit form using a small utility in packages/integration-client.
  • Build a reusable WalletAddress display component: truncates by default, expand-on-click, copy-to-clipboard with a success toast, and a link-out to a block explorer.
  • Add a confirmation dialog for destructive/sensitive wallet-linked actions (e.g., changing a member's linked wallet).
  • Add tests for the validation utility covering valid/invalid/edge-case addresses.

Acceptance criteria

  • Invalid wallet addresses are rejected on input with a clear error
  • Wallet addresses render truncated by default everywhere they appear
  • Copy-to-clipboard works and is covered by a test
  • Changing a member's wallet requires explicit confirmation

Likely affected files/directories

  • apps/dashboard/app/members/
  • apps/dashboard/components/ (new WalletAddress component)
  • packages/integration-client/

Metadata

Metadata

Labels

GrantFox OSSGrantFox Open Source Sponsorship program tagMaybe RewardedIssue may qualify for a reward upon successful completion per campaign rulesOfficial Campaign | FWC26Official FWC26 campaign issue — eligible for campaign scoring and rewardsadvancedAdvanced difficulty tasks requiring significant domain knowledge and implementation effortsecuritySecurity-related fix, hardening, audit, or vulnerability remediationui/uxUser interface or user experience improvements and design work

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions