Blockchain technology and decentralized applications (dAPPs) provide users with a number of advantages. For example, users can utilize the service without creating an account and it can be implemented as a single-page application written in JavaScript. Ever Surf is a cross-platform messenger, a blockchain browser, and a crypto wallet for Everscale blockchain. It is written in React Native and is available in Google Play Market and Apple Store. There is also a web version of Ever Surf that runs on any platform. This type of application does not require communication with a centralized infrastructure, such as a web server, and it can interact with the blockchain directly or by using a browser extension like Metamask. In this case, the user is identified using keys that are stored only on a local machine inside a browser extension or a web wallet. If a decentralized application or a wallet stores sensitive data locally, it must ensure this data is reliably protected. In most cases, dAPPs run inside the browser and therefore may be vulnerable to attacks such as XSS. This research describes the vulnerability found in the web version of Ever Surf, a wallet for the Everscale blockchain (formerly Free TON). By exploiting the vulnerability, it’s possible to decrypt the private keys and seed phrases that are stored in the browser’s local storage. In other words, attackers could gain full control over the victim's wallets. The Checkpoint Research (CPR) disclosed the vulnerability to Ever Surf developers who then released a desktop version that mitigates this vulnerability.

The web version is now declared deprecated and should only be used for development purposes. Seed phrases from accounts that store real value in crypto should not be used in the web version of Ever Surf. After responsible disclosure, Check Point Research collaborated with the Everscale teams, which acknowledged the vulnerability and released a new desktop version to replace the vulnerable web v.