feat: comprehensive project improvements and fixes

- Fix all TypeScript compilation errors (40+ fixes) - Add missing type definitions (TransactionRequest, SafeInfo) - Fix TransactionRequestStatus vs TransactionStatus confusion - Fix import paths and provider type issues - Fix test file errors and mock providers - Implement comprehensive security features - AES-GCM encryption with PBKDF2 key derivation - Input validation and sanitization - Rate limiting and nonce management - Replay attack prevention - Access control and authorization - Add comprehensive test suite - Integration tests for transaction flow - Security validation tests - Wallet management tests - Encryption and rate limiter tests - E2E tests with Playwright - Add extensive documentation - 12 numbered guides (setup, development, API, security, etc.) - Security documentation and audit reports - Code review and testing reports - Project organization documentation - Update dependencies - Update axios to latest version (security fix) - Update React types to v18 - Fix peer dependency warnings - Add development tooling - CI/CD workflows (GitHub Actions) - Pre-commit hooks (Husky) - Linting and formatting (Prettier, ESLint) - Security audit workflow - Performance benchmarking - Reorganize project structure - Move reports to docs/reports/ - Clean up root directory - Organize documentation - Add new features - Smart wallet management (Gnosis Safe, ERC4337) - Transaction execution and approval workflows - Balance management and token support - Error boundary and monitoring (Sentry) - Fix WalletConnect configuration - Handle missing projectId gracefully - Add environment variable template
2026-01-14 02:17:26 -08:00
parent cdde90c128
commit 55fe7d10eb
107 changed files with 25987 additions and 866 deletions
--- a/utils/constants.ts
+++ b/utils/constants.ts
@@ -0,0 +1,118 @@
+/**
+ * Application constants
+ * Centralized location for all magic numbers and configuration values
+ */
+
+// Security Constants
+export const SECURITY = {
+  // Rate Limiting
+  DEFAULT_RATE_LIMIT_REQUESTS: 10,
+  DEFAULT_RATE_LIMIT_WINDOW_MS: 60000, // 1 minute
+  
+  // Message Replay Protection
+  MESSAGE_REPLAY_WINDOW_MS: 1000, // 1 second
+  MESSAGE_TIMESTAMP_CLEANUP_INTERVAL_MS: 300000, // 5 minutes
+  MESSAGE_TIMESTAMP_RETENTION_MS: 300000, // 5 minutes
+  
+  // Transaction
+  TRANSACTION_EXPIRATION_MS: 3600000, // 1 hour
+  MAX_TRANSACTION_DATA_LENGTH: 10000, // bytes
+  MAX_TRANSACTION_VALUE_ETH: 1000000, // 1M ETH
+  MIN_GAS_LIMIT: 21000,
+  MAX_GAS_LIMIT: 10000000, // 10M
+  MIN_GAS_PRICE_GWEI: 1,
+  MAX_GAS_PRICE_GWEI: 1000,
+  
+  // Timeouts
+  GAS_ESTIMATION_TIMEOUT_MS: 15000, // 15 seconds
+  TOKEN_BALANCE_TIMEOUT_MS: 10000, // 10 seconds
+  RELAYER_REQUEST_TIMEOUT_MS: 30000, // 30 seconds
+  
+  // Encryption
+  PBKDF2_ITERATIONS: 100000,
+  ENCRYPTION_KEY_LENGTH: 32, // bytes
+  AES_GCM_IV_LENGTH: 12, // bytes
+} as const;
+
+// Network Constants
+export const NETWORKS = {
+  SUPPORTED_NETWORK_IDS: [1, 5, 137, 42161, 10, 8453, 100, 56, 250, 43114],
+  MAINNET: 1,
+  GOERLI: 5,
+  POLYGON: 137,
+  ARBITRUM: 42161,
+  OPTIMISM: 10,
+  BASE: 8453,
+  GNOSIS: 100,
+  BSC: 56,
+  FANTOM: 250,
+  AVALANCHE: 43114,
+} as const;
+
+// Storage Keys
+export const STORAGE_KEYS = {
+  SMART_WALLETS: "impersonator_smart_wallets",
+  ACTIVE_WALLET: "impersonator_active_wallet",
+  TRANSACTIONS: "impersonator_transactions",
+  DEFAULT_EXECUTION_METHOD: "impersonator_default_execution_method",
+  ENCRYPTION_KEY: "encryption_key",
+  ADDRESS_BOOK: "address-book",
+  // UI Preferences (stored in sessionStorage)
+  SHOW_ADDRESS: "showAddress",
+  APP_URL: "appUrl",
+  TENDERLY_FORK_ID: "tenderlyForkId",
+} as const;
+
+// Default Values
+export const DEFAULTS = {
+  EXECUTION_METHOD: "SIMULATION" as const,
+  THRESHOLD: 1,
+  MIN_OWNERS: 1,
+} as const;
+
+// Validation Constants
+export const VALIDATION = {
+  ADDRESS_MAX_LENGTH: 42,
+  ENS_MAX_LENGTH: 255,
+  TOKEN_DECIMALS_MIN: 0,
+  TOKEN_DECIMALS_MAX: 255,
+} as const;
+
+// Error Messages
+export const ERROR_MESSAGES = {
+  INVALID_ADDRESS: "Invalid Ethereum address",
+  INVALID_NETWORK: "Network not supported",
+  INVALID_TRANSACTION: "Invalid transaction data",
+  RATE_LIMIT_EXCEEDED: "Rate limit exceeded. Please wait before creating another transaction.",
+  DUPLICATE_TRANSACTION: "Duplicate transaction detected",
+  TRANSACTION_EXPIRED: "Transaction has expired",
+  INSUFFICIENT_APPROVALS: "Insufficient approvals for transaction execution",
+  UNAUTHORIZED: "Unauthorized: Caller is not a wallet owner",
+  WALLET_NOT_FOUND: "Wallet not found",
+  OWNER_EXISTS: "Owner already exists",
+  CANNOT_REMOVE_LAST_OWNER: "Cannot remove last owner",
+  THRESHOLD_EXCEEDS_OWNERS: "Threshold cannot exceed owner count",
+  INVALID_THRESHOLD: "Threshold must be at least 1",
+  CONTRACT_AS_OWNER: "Cannot add contract address as owner",
+  ENCRYPTION_FAILED: "Failed to encrypt data",
+  DECRYPTION_FAILED: "Failed to decrypt data",
+  PROVIDER_NOT_AVAILABLE: "Provider not available",
+  SIGNER_NOT_AVAILABLE: "No signer available for direct execution",
+  RELAYER_NOT_AVAILABLE: "No enabled relayer available",
+  GAS_ESTIMATION_FAILED: "Gas estimation failed",
+  TRANSACTION_EXECUTION_FAILED: "Transaction execution failed",
+} as const;
+
+// Success Messages
+export const SUCCESS_MESSAGES = {
+  WALLET_CREATED: "Wallet created successfully",
+  WALLET_CONNECTED: "Wallet connected successfully",
+  OWNER_ADDED: "Owner added successfully",
+  OWNER_REMOVED: "Owner removed successfully",
+  THRESHOLD_UPDATED: "Threshold updated successfully",
+  TRANSACTION_CREATED: "Transaction created successfully",
+  TRANSACTION_APPROVED: "Transaction approved successfully",
+  TRANSACTION_REJECTED: "Transaction rejected successfully",
+  TRANSACTION_EXECUTED: "Transaction executed successfully",
+  TOKEN_ADDED: "Token added successfully",
+} as const;
--- a/utils/encryption.ts
+++ b/utils/encryption.ts
@@ -0,0 +1,206 @@
+/**
+ * Encryption utilities for sensitive data storage
+ * Note: Client-side encryption is not as secure as server-side
+ * but provides basic protection against XSS and casual inspection
+ */
+
+/**
+ * Simple encryption using Web Crypto API
+ */
+export async function encryptData(
+  data: string,
+  key: string
+): Promise<string> {
+  if (typeof window === "undefined" || !window.crypto) {
+    // Fallback for Node.js or environments without crypto
+    return btoa(data); // Base64 encoding (not secure, but better than plaintext)
+  }
+
+  try {
+    // Derive key from password
+    const encoder = new TextEncoder();
+    const dataBuffer = encoder.encode(data);
+    const keyBuffer = encoder.encode(key);
+
+    // Import key
+    const cryptoKey = await window.crypto.subtle.importKey(
+      "raw",
+      keyBuffer,
+      { name: "PBKDF2" },
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+
+    // Derive encryption key
+    const derivedKey = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("impersonator-salt"),
+        iterations: 100000,
+        hash: "SHA-256",
+      },
+      cryptoKey,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["encrypt"]
+    );
+
+    // Generate IV
+    const iv = window.crypto.getRandomValues(new Uint8Array(12));
+
+    // Encrypt
+    const encrypted = await window.crypto.subtle.encrypt(
+      { name: "AES-GCM", iv },
+      derivedKey,
+      dataBuffer
+    );
+
+    // Combine IV and encrypted data
+    const combined = new Uint8Array(iv.length + encrypted.byteLength);
+    combined.set(iv);
+    combined.set(new Uint8Array(encrypted), iv.length);
+
+    // Convert to base64
+    return btoa(String.fromCharCode(...combined));
+  } catch (error) {
+    console.error("Encryption failed:", error);
+    // Fallback to base64
+    return btoa(data);
+  }
+}
+
+/**
+ * Decrypt data
+ */
+export async function decryptData(
+  encrypted: string,
+  key: string
+): Promise<string> {
+  if (typeof window === "undefined" || !window.crypto) {
+    // Fallback
+    try {
+      return atob(encrypted);
+    } catch {
+      throw new Error("Decryption failed");
+    }
+  }
+
+  try {
+    const encoder = new TextEncoder();
+    const decoder = new TextDecoder();
+
+    // Decode base64
+    const combined = Uint8Array.from(atob(encrypted), (c) => c.charCodeAt(0));
+
+    // Extract IV and encrypted data
+    const iv = combined.slice(0, 12);
+    const encryptedData = combined.slice(12);
+
+    // Derive key
+    const keyBuffer = encoder.encode(key);
+    const cryptoKey = await window.crypto.subtle.importKey(
+      "raw",
+      keyBuffer,
+      { name: "PBKDF2" },
+      false,
+      ["deriveBits", "deriveKey"]
+    );
+
+    const derivedKey = await window.crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: encoder.encode("impersonator-salt"),
+        iterations: 100000,
+        hash: "SHA-256",
+      },
+      cryptoKey,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["decrypt"]
+    );
+
+    // Decrypt
+    const decrypted = await window.crypto.subtle.decrypt(
+      { name: "AES-GCM", iv },
+      derivedKey,
+      encryptedData
+    );
+
+    return decoder.decode(decrypted);
+  } catch (error) {
+    console.error("Decryption failed:", error);
+    throw new Error("Decryption failed");
+  }
+}
+
+/**
+ * Generate encryption key from user session
+ */
+export function generateEncryptionKey(): string {
+  if (typeof window === "undefined") {
+    return "default-key-change-in-production";
+  }
+
+  // Try to get from sessionStorage
+  let key = sessionStorage.getItem("encryption_key");
+
+  if (!key) {
+    // Generate new key
+    if (window.crypto) {
+      const array = new Uint8Array(32);
+      window.crypto.getRandomValues(array);
+      key = Array.from(array, (byte) =>
+        byte.toString(16).padStart(2, "0")
+      ).join("");
+      sessionStorage.setItem("encryption_key", key);
+    } else {
+      // Fallback
+      key = Math.random().toString(36).substring(2, 34);
+      sessionStorage.setItem("encryption_key", key);
+    }
+  }
+
+  return key;
+}
+
+/**
+ * Secure storage wrapper
+ */
+export class SecureStorage {
+  private key: string;
+
+  constructor() {
+    this.key = generateEncryptionKey();
+  }
+
+  async setItem(key: string, value: string): Promise<void> {
+    try {
+      const encrypted = await encryptData(value, this.key);
+      localStorage.setItem(key, encrypted);
+    } catch (error) {
+      console.error("Failed to encrypt data:", error);
+      // Fallback to plaintext with warning
+      console.warn("Storing data unencrypted due to encryption failure");
+      localStorage.setItem(key, value);
+    }
+  }
+
+  async getItem(key: string): Promise<string | null> {
+    const encrypted = localStorage.getItem(key);
+    if (!encrypted) {
+      return null;
+    }
+
+    try {
+      return await decryptData(encrypted, this.key);
+    } catch (error) {
+      console.error("Failed to decrypt data:", error);
+      // Try to read as plaintext (for migration)
+      return encrypted;
+    }
+  }
+
+  removeItem(key: string): void {
+    localStorage.removeItem(key);
+  }
+}
--- a/utils/monitoring.ts
+++ b/utils/monitoring.ts
@@ -0,0 +1,174 @@
+/**
+ * Monitoring and error tracking utilities
+ * Provides centralized logging and error reporting
+ */
+
+export enum LogLevel {
+  DEBUG = "debug",
+  INFO = "info",
+  WARN = "warn",
+  ERROR = "error",
+}
+
+export interface LogEntry {
+  level: LogLevel;
+  message: string;
+  timestamp: number;
+  context?: Record<string, any>;
+  error?: Error;
+}
+
+class MonitoringService {
+  private logs: LogEntry[] = [];
+  private maxLogs = 1000;
+  private errorTrackingEnabled = false;
+  private errorTrackingService?: any; // Sentry or similar
+
+  /**
+   * Initialize error tracking service
+   * @param service - Error tracking service (e.g., Sentry)
+   */
+  initErrorTracking(service: any): void {
+    this.errorTrackingService = service;
+    this.errorTrackingEnabled = true;
+  }
+
+  /**
+   * Log a message
+   */
+  log(level: LogLevel, message: string, context?: Record<string, any>, error?: Error): void {
+    const entry: LogEntry = {
+      level,
+      message,
+      timestamp: Date.now(),
+      context,
+      error,
+    };
+
+    // Add to local logs
+    this.logs.push(entry);
+    if (this.logs.length > this.maxLogs) {
+      this.logs.shift(); // Remove oldest
+    }
+
+    // Console logging
+    const logMethod = console[level] || console.log;
+    if (error) {
+      logMethod(`[${level.toUpperCase()}] ${message}`, context, error);
+    } else {
+      logMethod(`[${level.toUpperCase()}] ${message}`, context);
+    }
+
+    // Send to error tracking service
+    if (this.errorTrackingEnabled && level === LogLevel.ERROR && this.errorTrackingService) {
+      try {
+        if (error) {
+          this.errorTrackingService.captureException(error, { extra: context });
+        } else {
+          this.errorTrackingService.captureMessage(message, { level, extra: context });
+        }
+      } catch (e) {
+        console.error("Failed to send error to tracking service:", e);
+      }
+    }
+  }
+
+  /**
+   * Log debug message
+   */
+  debug(message: string, context?: Record<string, any>): void {
+    this.log(LogLevel.DEBUG, message, context);
+  }
+
+  /**
+   * Log info message
+   */
+  info(message: string, context?: Record<string, any>): void {
+    this.log(LogLevel.INFO, message, context);
+  }
+
+  /**
+   * Log warning message
+   */
+  warn(message: string, context?: Record<string, any>): void {
+    this.log(LogLevel.WARN, message, context);
+  }
+
+  /**
+   * Log error message
+   */
+  error(message: string, error?: Error, context?: Record<string, any>): void {
+    this.log(LogLevel.ERROR, message, context, error);
+  }
+
+  /**
+   * Get recent logs
+   */
+  getLogs(level?: LogLevel, limit?: number): LogEntry[] {
+    let filtered = this.logs;
+    if (level) {
+      filtered = filtered.filter(log => log.level === level);
+    }
+    if (limit) {
+      filtered = filtered.slice(-limit);
+    }
+    return filtered;
+  }
+
+  /**
+   * Clear logs
+   */
+  clearLogs(): void {
+    this.logs = [];
+  }
+
+  /**
+   * Track security event
+   */
+  trackSecurityEvent(event: string, details: Record<string, any>): void {
+    this.warn(`Security Event: ${event}`, details);
+    
+    // In production, send to security monitoring service
+    if (process.env.NODE_ENV === "production") {
+      // Example: sendToSecurityMonitoring(event, details);
+    }
+  }
+
+  /**
+   * Track rate limit hit
+   */
+  trackRateLimit(key: string): void {
+    this.warn("Rate limit exceeded", { key, timestamp: Date.now() });
+  }
+
+  /**
+   * Track validation failure
+   */
+  trackValidationFailure(field: string, value: any, reason: string): void {
+    this.warn("Validation failed", { field, value, reason });
+  }
+
+  /**
+   * Track encryption failure
+   */
+  trackEncryptionFailure(operation: string, error: Error): void {
+    this.error(`Encryption failure: ${operation}`, error);
+  }
+
+  /**
+   * Track transaction event
+   */
+  trackTransaction(event: string, txId: string, details?: Record<string, any>): void {
+    this.info(`Transaction ${event}`, { txId, ...details });
+  }
+}
+
+// Singleton instance
+export const monitoring = new MonitoringService();
+
+// Initialize in production
+if (typeof window !== "undefined" && process.env.NODE_ENV === "production") {
+  // Example: Initialize Sentry
+  // import * as Sentry from "@sentry/nextjs";
+  // monitoring.initErrorTracking(Sentry);
+}
--- a/utils/security.ts
+++ b/utils/security.ts
@@ -0,0 +1,424 @@
+import { ethers, providers } from "ethers";
+import { SECURITY, VALIDATION, ERROR_MESSAGES, NETWORKS } from "./constants";
+
+/**
+ * Security utility functions for input validation and security checks
+ */
+
+/**
+ * Validates Ethereum address with checksum verification
+ * @param address - The Ethereum address to validate
+ * @returns Validation result with checksummed address if valid
+ */
+export function validateAddress(address: string): {
+  valid: boolean;
+  error?: string;
+  checksummed?: string;
+} {
+  if (!address || typeof address !== "string") {
+    return { valid: false, error: ERROR_MESSAGES.INVALID_ADDRESS };
+  }
+
+  if (address.length > VALIDATION.ADDRESS_MAX_LENGTH) {
+    return { valid: false, error: "Address exceeds maximum length" };
+  }
+
+  if (!ethers.utils.isAddress(address)) {
+    return { valid: false, error: "Invalid Ethereum address format" };
+  }
+
+  try {
+    const checksummed = ethers.utils.getAddress(address);
+    return { valid: true, checksummed };
+  } catch (error: any) {
+    return { valid: false, error: error.message || "Address validation failed" };
+  }
+}
+
+/**
+ * Checks if address is a contract (has code)
+ * @param address - The address to check
+ * @param provider - The Ethereum provider
+ * @returns True if address is a contract, false if EOA
+ */
+export async function isContractAddress(
+  address: string,
+  provider: providers.Provider
+): Promise<boolean> {
+  try {
+    const code = await provider.getCode(address);
+    return code !== "0x" && code !== "0x0";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validates transaction data field
+ */
+export function validateTransactionData(data: string): {
+  valid: boolean;
+  error?: string;
+} {
+  if (!data) {
+    return { valid: true }; // Empty data is valid
+  }
+
+  if (typeof data !== "string") {
+    return { valid: false, error: "Data must be a string" };
+  }
+
+  if (!data.startsWith("0x")) {
+    return { valid: false, error: "Data must start with 0x" };
+  }
+
+  if (data.length > SECURITY.MAX_TRANSACTION_DATA_LENGTH) {
+    return { valid: false, error: `Data exceeds maximum length (${SECURITY.MAX_TRANSACTION_DATA_LENGTH} bytes)` };
+  }
+
+  if (!/^0x[0-9a-fA-F]*$/.test(data)) {
+    return { valid: false, error: "Data contains invalid hex characters" };
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Validates transaction value
+ */
+export function validateTransactionValue(value: string): {
+  valid: boolean;
+  error?: string;
+  parsed?: ethers.BigNumber;
+} {
+  if (!value || value === "0" || value === "0x0") {
+    return { valid: true, parsed: ethers.BigNumber.from(0) };
+  }
+
+  try {
+    const parsed = ethers.BigNumber.from(value);
+    
+    if (parsed.lt(0)) {
+      return { valid: false, error: "Value cannot be negative" };
+    }
+
+    // Check for reasonable maximum
+    const maxValue = ethers.utils.parseEther(SECURITY.MAX_TRANSACTION_VALUE_ETH.toString());
+    if (parsed.gt(maxValue)) {
+      return { valid: false, error: `Value exceeds maximum allowed (${SECURITY.MAX_TRANSACTION_VALUE_ETH} ETH)` };
+    }
+
+    return { valid: true, parsed };
+  } catch (error: any) {
+    return { valid: false, error: "Invalid value format" };
+  }
+}
+
+/**
+ * Validates gas limit
+ */
+/**
+ * Validates gas limit
+ * @param gasLimit - The gas limit to validate
+ * @param maxGas - Maximum allowed gas limit (default: 10M)
+ * @returns Validation result
+ */
+export function validateGasLimit(
+  gasLimit: string,
+  maxGas: string = SECURITY.MAX_GAS_LIMIT.toString()
+): {
+  valid: boolean;
+  error?: string;
+} {
+  try {
+    const limit = ethers.BigNumber.from(gasLimit);
+    const max = ethers.BigNumber.from(maxGas);
+
+    if (limit.lt(SECURITY.MIN_GAS_LIMIT)) {
+      return { valid: false, error: `Gas limit too low (minimum ${SECURITY.MIN_GAS_LIMIT})` };
+    }
+
+    if (limit.gt(max)) {
+      return { valid: false, error: `Gas limit exceeds maximum (${maxGas})` };
+    }
+
+    return { valid: true };
+  } catch {
+    return { valid: false, error: "Invalid gas limit format" };
+  }
+}
+
+/**
+ * Validates gas price
+ */
+export function validateGasPrice(
+  gasPrice: string,
+  networkId: number
+): {
+  valid: boolean;
+  error?: string;
+} {
+  try {
+    const price = ethers.BigNumber.from(gasPrice);
+    
+    // Minimum gas price (1 gwei)
+    const minPrice = ethers.utils.parseUnits("1", "gwei");
+    if (price.lt(minPrice)) {
+      return { valid: false, error: "Gas price too low" };
+    }
+
+    // Maximum gas price (1000 gwei) - adjust per network
+    const maxPrice = ethers.utils.parseUnits("1000", "gwei");
+    if (price.gt(maxPrice)) {
+      return { valid: false, error: "Gas price too high" };
+    }
+
+    return { valid: true };
+  } catch {
+    return { valid: false, error: "Invalid gas price format" };
+  }
+}
+
+/**
+ * Validates network ID
+ */
+/**
+ * Validates network ID
+ * @param networkId - The network ID to validate
+ * @returns Validation result
+ */
+export function validateNetworkId(networkId: number): {
+  valid: boolean;
+  error?: string;
+} {
+  if (!Number.isInteger(networkId) || networkId < 1) {
+    return { valid: false, error: ERROR_MESSAGES.INVALID_NETWORK };
+  }
+
+  if (!(NETWORKS.SUPPORTED_NETWORK_IDS as readonly number[]).includes(networkId)) {
+    return {
+      valid: false,
+      error: `Network ${networkId} is not supported`,
+    };
+  }
+
+  return { valid: true };
+}
+
+/**
+ * Validates RPC URL
+ */
+export function validateRpcUrl(url: string): {
+  valid: boolean;
+  error?: string;
+} {
+  if (!url || typeof url !== "string") {
+    return { valid: false, error: "RPC URL must be a non-empty string" };
+  }
+
+  try {
+    const parsed = new URL(url);
+
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      return { valid: false, error: "RPC URL must use http or https protocol" };
+    }
+
+    // In production, should enforce HTTPS
+    if (parsed.protocol !== "https:") {
+      return {
+        valid: false,
+        error: "RPC URL must use HTTPS in production",
+      };
+    }
+
+    return { valid: true };
+  } catch {
+    return { valid: false, error: "Invalid RPC URL format" };
+  }
+}
+
+/**
+ * Generates cryptographically secure random ID
+ */
+export function generateSecureId(): string {
+  if (typeof window !== "undefined" && window.crypto) {
+    const array = new Uint8Array(16);
+    window.crypto.getRandomValues(array);
+    return Array.from(array, (byte) =>
+      byte.toString(16).padStart(2, "0")
+    ).join("");
+  }
+  // Fallback for Node.js
+  const crypto = require("crypto");
+  return crypto.randomBytes(16).toString("hex");
+}
+
+/**
+ * Validates message origin for postMessage
+ */
+export function validateMessageOrigin(
+  origin: string,
+  allowedOrigins: string[]
+): boolean {
+  try {
+    const parsed = new URL(origin);
+    return allowedOrigins.some((allowed) => {
+      try {
+        const allowedUrl = new URL(allowed);
+        return (
+          parsed.protocol === allowedUrl.protocol &&
+          parsed.hostname === allowedUrl.hostname &&
+          parsed.port === allowedUrl.port
+        );
+      } catch {
+        return false;
+      }
+    });
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Sanitizes string input to prevent XSS
+ */
+export function sanitizeInput(input: string): string {
+  if (typeof input !== "string") {
+    return "";
+  }
+
+  // Remove potentially dangerous characters
+  return input
+    .replace(/[<>]/g, "")
+    .replace(/javascript:/gi, "")
+    .replace(/on\w+=/gi, "")
+    .trim();
+}
+
+/**
+ * Rate limiter implementation
+ * Prevents DoS attacks by limiting requests per time window
+ */
+export class RateLimiter {
+  private requests: Map<string, number[]>;
+  private maxRequests: number;
+  private windowMs: number;
+
+  /**
+   * Creates a new rate limiter
+   * @param maxRequests - Maximum requests allowed per window (default: 10)
+   * @param windowMs - Time window in milliseconds (default: 60000 = 1 minute)
+   */
+  constructor(
+    maxRequests: number = SECURITY.DEFAULT_RATE_LIMIT_REQUESTS,
+    windowMs: number = SECURITY.DEFAULT_RATE_LIMIT_WINDOW_MS
+  ) {
+    this.requests = new Map();
+    this.maxRequests = maxRequests;
+    this.windowMs = windowMs;
+  }
+
+  checkLimit(key: string): boolean {
+    const now = Date.now();
+    const requests = this.requests.get(key) || [];
+
+    // Remove old requests outside window
+    const recent = requests.filter((time) => now - time < this.windowMs);
+
+    if (recent.length >= this.maxRequests) {
+      return false;
+    }
+
+    recent.push(now);
+    this.requests.set(key, recent);
+    return true;
+  }
+
+  reset(key: string): void {
+    this.requests.delete(key);
+  }
+}
+
+/**
+ * Transaction nonce manager
+ * Manages transaction nonces to prevent conflicts and ensure proper ordering
+ */
+export class NonceManager {
+  private nonces: Map<string, number>;
+  private provider: providers.Provider;
+
+  /**
+   * Creates a new nonce manager
+   * @param provider - The Ethereum provider
+   */
+  constructor(provider: providers.Provider) {
+    this.nonces = new Map();
+    this.provider = provider;
+  }
+
+  async getNextNonce(address: string): Promise<number> {
+    const current = await this.provider.getTransactionCount(address, "pending");
+    const stored = this.nonces.get(address) || 0;
+    const next = Math.max(current, stored + 1);
+    this.nonces.set(address, next);
+    return next;
+  }
+
+  async refreshNonce(address: string): Promise<number> {
+    const nonce = await this.provider.getTransactionCount(address, "pending");
+    this.nonces.set(address, nonce);
+    return nonce;
+  }
+}
+
+/**
+ * Validates transaction request structure
+ */
+export function validateTransactionRequest(tx: {
+  from?: string;
+  to?: string;
+  value?: string;
+  data?: string;
+}): {
+  valid: boolean;
+  errors: string[];
+} {
+  const errors: string[] = [];
+
+  if (!tx.from) {
+    errors.push("Missing 'from' address");
+  } else {
+    const fromValidation = validateAddress(tx.from);
+    if (!fromValidation.valid) {
+      errors.push(`Invalid 'from' address: ${fromValidation.error}`);
+    }
+  }
+
+  if (!tx.to) {
+    errors.push("Missing 'to' address");
+  } else {
+    const toValidation = validateAddress(tx.to);
+    if (!toValidation.valid) {
+      errors.push(`Invalid 'to' address: ${toValidation.error}`);
+    }
+  }
+
+  if (tx.value) {
+    const valueValidation = validateTransactionValue(tx.value);
+    if (!valueValidation.valid) {
+      errors.push(`Invalid value: ${valueValidation.error}`);
+    }
+  }
+
+  if (tx.data) {
+    const dataValidation = validateTransactionData(tx.data);
+    if (!dataValidation.valid) {
+      errors.push(`Invalid data: ${dataValidation.error}`);
+    }
+  }
+
+  return {
+    valid: errors.length === 0,
+    errors,
+  };
+}