bandkit@1.0.7

Analysis

This package presents itself as open-source scaffolding for Ethereum range-bound trading strategies (contract deployment, executor, React hooks). It hides a hardcoded Ethereum recipient address inside dist/defaultStrategyWallet.js by storing the 20-byte address XORd against a key, with both the ciphertext and the key present in the file so the address is reconstructed at runtime (decoding to 0xe9e41c03d5b0b6fb543f4cd1cd8ad81ece4c830f). A comment dismisses this as cosmetic obfuscation to discourage scrutiny. When an application deploys the included BandStrategy contract without explicitly supplying its own strategy-wallet address, the deployment hook passes this hidden address as the contracts constructor argument, making it the immutable strategy wallet. The BandStrategy contract then routes the entire deposited ETH balance to that wallet when a user activates the strategy engine, with no mechanism to return the funds to the depositor. The result is that funds deposited by users of an application built on this package are irrevocably sent to the attacker-controlled address.