Lock and dispatch event before attempting unlock to ensure secrets are zeroed prior...

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index 5e9f55513df4d1e50963ef37aafe0c8bdb9150c2..576f7d63cce3244c0caa3c7071e51c649777cc2a 100644 (file)
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -317,45 +317,48 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
  * Decrypts the input and sets the seed and, if it is included, the mnemonic.
  */
 function unlock (type?: WalletType, id?: UUID, key?: CryptoKey, iv?: ArrayBuffer, encrypted?: ArrayBuffer): Promise<Record<string, boolean>> {
-       if (type == null) {
-               throw new VaultError('Wallet type is required')
-       }
-       if (type !== 'BIP-44' && type !== 'BLAKE2b' && type !== 'Exodus') {
-               throw new VaultError('Invalid wallet type', { cause: type })
-       }
-       if (id == null) {
-               throw new VaultError('Wallet ID is required')
-       }
-       if (key == null) {
-               throw new VaultError('Wallet password is required')
-       }
-       if (iv == null) {
-               throw new VaultError('Wallet IV is required')
-       }
-       if (encrypted == null) {
-               throw new VaultError('Wallet encrypted data is required')
-       }
-       _timer?.pause()
-       return WalletAesGcm.decrypt(type, id, key, iv, encrypted)
-               .then(({ mnemonic, seed }) => {
-                       if (!(seed instanceof ArrayBuffer)) {
-                               throw new VaultError('Invalid seed')
+       return _autolock()
+               .then(() => {
+                       if (type == null) {
+                               throw new VaultError('Wallet type is required')
                        }
-                       if (mnemonic != null && !(mnemonic instanceof ArrayBuffer)) {
-                               throw new VaultError('Invalid mnemonic')
+                       if (type !== 'BIP-44' && type !== 'BLAKE2b' && type !== 'Exodus') {
+                               throw new VaultError('Invalid wallet type', { cause: type })
                        }
-                       _type = type
-                       _id = id
-                       _seed = seed
-                       _mnemonic = mnemonic
-                       _locked = false
-                       _timer = new VaultTimer(_autolock, _timeout)
-                       return Promise.resolve({ isLocked: false })
-               })
-               .catch(err => {
-                       console.error(err)
-                       _timer?.resume()
-                       throw new VaultError('Failed to unlock wallet', { cause: err })
+                       if (id == null) {
+                               throw new VaultError('Wallet ID is required')
+                       }
+                       if (key == null) {
+                               throw new VaultError('Wallet password is required')
+                       }
+                       if (iv == null) {
+                               throw new VaultError('Wallet IV is required')
+                       }
+                       if (encrypted == null) {
+                               throw new VaultError('Wallet encrypted data is required')
+                       }
+                       _timer?.pause()
+                       return WalletAesGcm.decrypt(type, id, key, iv, encrypted)
+                               .then(({ mnemonic, seed }) => {
+                                       if (!(seed instanceof ArrayBuffer)) {
+                                               throw new VaultError('Invalid seed')
+                                       }
+                                       if (mnemonic != null && !(mnemonic instanceof ArrayBuffer)) {
+                                               throw new VaultError('Invalid mnemonic')
+                                       }
+                                       _type = type
+                                       _id = id
+                                       _seed = seed
+                                       _mnemonic = mnemonic
+                                       _locked = false
+                                       _timer = new VaultTimer(_autolock, _timeout)
+                                       return Promise.resolve({ isLocked: false })
+                               })
+                               .catch(err => {
+                                       console.error(err)
+                                       _timer?.resume()
+                                       throw new VaultError('Failed to unlock wallet', { cause: err })
+                               })
                })
 }