arkavo-org / arkavo-org/app

🔴 CRITICAL: Replace force unwraps in security-critical code

Open
#206 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug tech debt
Dominant language
Swift
Stars
0
Forks
0
Avg merge
1h 41m
Merged PRs (30d)
1

Description

Problem

The codebase contains 11+ force unwraps and fatalError calls in security-critical paths that can cause production crashes.

Affected Files

File Line Issue
ArkavoApp.swift 1044 fatalError("No registered service for type \(T.self)")
ArkavoApp.swift 1159 return peerDiscoveryManager!
AuthenticationManager.swift 374-375 Force unwrap on SecKeyCopyPublicKey
ArkavoWebSocket.swift Multiple Force unwraps on connection state
IDCardScannerViewController.swift Multiple Force unwraps on UI elements

Impact

  • Severity: Critical
  • Risk: App crashes in production when preconditions not met
  • User Impact: Authentication failures, data loss

Solution

  1. Replace fatalError with proper error handling (throw/Result)
  2. Replace ! force unwraps with guard let + error handling
  3. Add graceful degradation for missing services
  4. Log errors instead of crashing

Acceptance Criteria

  • Zero force unwraps in AuthenticationManager.swift
  • Zero force unwraps in ArkavoWebSocket.swift
  • ServiceLocator returns nil or throws instead of fatalError
  • All security paths have proper error recovery

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by auditing the listed Swift files: ArkavoApp.swift, AuthenticationManager.swift, ArkavoWebSocket.swift, and IDCardScannerViewController.swift, focusing on the reported force unwraps and fatalError calls. Trace how each security-critical path handles missing values or services. Done means the stated force unwraps are removed, ServiceLocator no longer crashes on missing services, and all security paths have error recovery.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
mobile, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.