From 0543cd5950521e5406f4aa4a525ae0bc3254bffa Mon Sep 17 00:00:00 2001
From: Chris Duncan <chris@codecow.com>
Date: Sun, 9 Aug 2026 20:51:20 -0700
Subject: [PATCH] Lock and dispatch event before attempting unlock to ensure
 secrets are zeroed prior to success or failure.

---
 src/lib/vault/vault-worker.ts | 77 ++++++++++++++++++-----------------
 1 file changed, 40 insertions(+), 37 deletions(-)

diff --git a/src/lib/vault/vault-worker.ts b/src/lib/vault/vault-worker.ts
index 5e9f555..576f7d6 100644
--- a/src/lib/vault/vault-worker.ts
+++ b/src/lib/vault/vault-worker.ts
@@ -317,45 +317,48 @@ function sign (index?: Uint32Array, data?: ArrayBuffer): Promise<Record<string,
  * Decrypts the input and sets the seed and, if it is included, the mnemonic.
  */
 function unlock (type?: WalletType, id?: UUID, key?: CryptoKey, iv?: ArrayBuffer, encrypted?: ArrayBuffer): Promise<Record<string, boolean>> {
-	if (type == null) {
-		throw new VaultError('Wallet type is required')
-	}
-	if (type !== 'BIP-44' && type !== 'BLAKE2b' && type !== 'Exodus') {
-		throw new VaultError('Invalid wallet type', { cause: type })
-	}
-	if (id == null) {
-		throw new VaultError('Wallet ID is required')
-	}
-	if (key == null) {
-		throw new VaultError('Wallet password is required')
-	}
-	if (iv == null) {
-		throw new VaultError('Wallet IV is required')
-	}
-	if (encrypted == null) {
-		throw new VaultError('Wallet encrypted data is required')
-	}
-	_timer?.pause()
-	return WalletAesGcm.decrypt(type, id, key, iv, encrypted)
-		.then(({ mnemonic, seed }) => {
-			if (!(seed instanceof ArrayBuffer)) {
-				throw new VaultError('Invalid seed')
+	return _autolock()
+		.then(() => {
+			if (type == null) {
+				throw new VaultError('Wallet type is required')
 			}
-			if (mnemonic != null && !(mnemonic instanceof ArrayBuffer)) {
-				throw new VaultError('Invalid mnemonic')
+			if (type !== 'BIP-44' && type !== 'BLAKE2b' && type !== 'Exodus') {
+				throw new VaultError('Invalid wallet type', { cause: type })
 			}
-			_type = type
-			_id = id
-			_seed = seed
-			_mnemonic = mnemonic
-			_locked = false
-			_timer = new VaultTimer(_autolock, _timeout)
-			return Promise.resolve({ isLocked: false })
-		})
-		.catch(err => {
-			console.error(err)
-			_timer?.resume()
-			throw new VaultError('Failed to unlock wallet', { cause: err })
+			if (id == null) {
+				throw new VaultError('Wallet ID is required')
+			}
+			if (key == null) {
+				throw new VaultError('Wallet password is required')
+			}
+			if (iv == null) {
+				throw new VaultError('Wallet IV is required')
+			}
+			if (encrypted == null) {
+				throw new VaultError('Wallet encrypted data is required')
+			}
+			_timer?.pause()
+			return WalletAesGcm.decrypt(type, id, key, iv, encrypted)
+				.then(({ mnemonic, seed }) => {
+					if (!(seed instanceof ArrayBuffer)) {
+						throw new VaultError('Invalid seed')
+					}
+					if (mnemonic != null && !(mnemonic instanceof ArrayBuffer)) {
+						throw new VaultError('Invalid mnemonic')
+					}
+					_type = type
+					_id = id
+					_seed = seed
+					_mnemonic = mnemonic
+					_locked = false
+					_timer = new VaultTimer(_autolock, _timeout)
+					return Promise.resolve({ isLocked: false })
+				})
+				.catch(err => {
+					console.error(err)
+					_timer?.resume()
+					throw new VaultError('Failed to unlock wallet', { cause: err })
+				})
 		})
 }
 
-- 
2.52.0