[New Snap] kobosu

[khanti42]

Checklist

All items in the list below needs to be satisfied.

• [x] Is the Snap repository publicly accessible and linked in this ticket: https://github.com/DoggyFiOfficial/dogecoin-snap-public
• [x] Is the Snap distributed on npm and linked in this ticket: https://www.npmjs.com/package/@doggyfi-official/kobosu
• [x] Has an audit been performed and the audit report attached or linked in this issue ?
• [ ] Is a complete list of discovered vulnerabilities from the audit documented in this issue?
• [ ] For vulnerabilities that have been deemed necessary to be addressed, are the links to the fixes attached to this issue?
• [ ] For vulnerabilities that have been deemed not necessary to be addressed, is a reason for each of them documented in this issue?
• [ ] The corresponding pull request in this repo has been merged.

Audit

Auditor : Sayfer Link : https://sayfer.io/audits/metamask-snap-audit-report-for-doggyfi/

Security Assessment Findings:

1. Fees Are Not Displayed to the User (ID: SAY-01)

   • Status: Fixed
   • Risk: Medium
   • Issue: Users were not shown the transaction fees upfront in the confirmation prompt, leading to a potential breach of trust.
   • Mitigation: Fees are now displayed separately in the initial prompt.

2. Dependencies with Floating Versions (ID: SAY-02)

   • Status: Fixed
   • Risk: Low
   • Issue: Dependencies were not pinned to exact versions, increasing the risk of supply chain attacks.
   • Mitigation: Use of exact versions for all packages is recommended.

3. Fee Data Not Displayed on Initial Prompt (ID: SAY-03)

   • Status: Acknowledged
   • Risk: Low
   • Issue: While fees are displayed, they only appear after the initial confirmation, which could lead to a poor UX as users might skip later prompts.
   • Mitigation: Fees should be presented in the first prompt.

4. Development Leftovers (ID: SAY-04)

   • Status: Fixed
   • Risk: Informational
   • Issue: There were comments and unfinished features in the code that had been overlooked.
   • Mitigation: Ensure all known issues are resolved before production.

[khanti42]

Production website not live yet : https://doggyfi.xyz/snap. Still demo : https://demo.doggyfi.xyz/snap. Waiting input from the team whether they want to proceed with demo website or if they can publish to production.