[hackerone]: blind cross chain signing should be prevented

[kdenhartog]

see https://hackerone.com/reports/1951016

[kjozwiak]

@diracdeltas should this be release-notes/include as it's a report from HackerOne?

[kjozwiak]

The above requires 1.51.105 or higher for 1.51.x verification 👍

[diracdeltas]

@kjozwiak yeah, we can just use the PR title for the release notes: "Reject Solana SignTransaction/SignAllTransactions when blockhash is invalid (credit: https://hackerone.com/julianor)"

[srirambv]

Verification passed on

Brave	1.51.109 Chromium: 113.0.5672.63 (Official Build) (64-bit)
Revision	0e1a4471d5ae5bf128b1bd8f4d627c8cbd55f70c-refs/branch-heads/5672@{#912}
OS	Linux

• Verified steps from brave/brave-core#18200 using https://pwgoom.csb.app
• Verified clicking on Sign Transaction (Invalid blockhash) doesn't show the panel for approval but instead shows [error] signTransactionWithInvalidBlockhash: {"code":-32603,"message":"Blockhash is invalid or can not be validated"}
• Verified clicking on Sign All Transaction (Invalid blockhash) doesn't show the panel for approval but instead shows [error] signAllTransactionsWithInvalidBlockhash: {"code":-32603,"message":"Blockhash is invalid or can not be validated"}
• Verified Sign Transaction (Invlalid blockhash) and Sign All Transactions (Invalid blockhash) fails when both Solana Mainnet and Solana Devnet are set as active network
  
  29798-2.mp4

---

• Verified steps from brave/brave-core#18200 of using the PoC setup
• Verified when no funds in Mainnet and attempt to send funds shows Result: Error: failed to send transaction: Transaction simulation failed: Attempt to debit an account but found no record of a prior credit. error message
• Verified when switching to Devnet and attempt to send funds shows Result: Error: Blockhash is invalid or can not be validated
  
  29798-1.mp4

---

Verified Sign Transaction and Sign All Transactions (multiple) works as expected.

29798-3.mp4

[srirambv]

Verification passed on Oppo Reno 5 with Android 13 running 1.51.109 x64 build

• Verified steps from brave/brave-core#18200 using https://pwgoom.csb.app
• Verified clicking on Sign Transaction (Invalid blockhash) doesn't show the panel for approval but instead shows [error] signTransactionWithInvalidBlockhash: {"code":-32603,"message":"Blockhash is invalid or can not be validated"}
• Verified clicking on Sign All Transaction (Invalid blockhash) doesn't show the panel for approval but instead shows [error] signAllTransactionsWithInvalidBlockhash: {"code":-32603,"message":"Blockhash is invalid or can not be validated"}
• Verified Sign Transaction (Invlalid blockhash) and Sign All Transactions (Invalid blockhash) fails when both Solana Mainnet and Solana Devnet are set as active network
• Verified Sign Transaction and Sign All Transactions (multiple) works as expected

29798.mp4