Mysten Multisig Toolkit

Every scenario DeepQA drove in the browser, in plan order, with the 34 screenshots it captured along the way. A passing scenario is evidence too.

1. S1

   Offline Signer - Connect and Sign

   4 steps, 3 screenshots

   highpass

   

   

   

   • A dialog ("Warning") covered the page on load, and neither its own controls nor the Escape key closed it, so what follows happened with it open.
   • Switched the network selector to testnet on the Offline Signer page.
   • Opened wallet picker dialog displaying DeepQA Test Wallet.
   • DeepQA Test Wallet connected successfully to the Offline Signer page.
   • Navigated to https://multisig-toolkit.mystenlabs.com/offline-signer and dismissed the initial warning modal.
   • Switched network selector dropdown from mainnet to testnet.
   • Clicked Connect Wallet button and selected DeepQA Test Wallet from the modal list.
   • DeepQA Test Wallet connected successfully, displaying the connected account and enabling form inputs.
   • Entered a base64 transaction string into the Transaction Bytes input, enabling the 'Sign Transaction' button and calculating the Ledger Transaction Hash.
2. S2

   Offline Signer - Preview Invalid Bytes

   4 steps, 1 screenshot

   highpass

   

   • Entered invalid_non_base64_string into Transaction Bytes and clicked Preview Effects, which displayed an Error message 'Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.' and 'Error computing hash'.
   • Navigated to /offline-signer and selected 'testnet' in the network selector dropdown.
   • Entered 'invalid_non_base64_string' into the Transaction Bytes input field.
   • Clicked 'Preview Effects' button.
   • The application gracefully caught and displayed the decoding error ('Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.') and 'Error computing hash' without crashing.
3. S3

   MultiSig Address - Create

   5 steps, 3 screenshotson-chain

   highpass

   

   

   

   • Navigated to MultiSig Address page showing public key input, weight, and threshold fields.
   • Clicked 'Create MultiSig Address' and observed derived Sui MultiSig Address 0x955a4ccc5dc9c9e3fca308490733f4eb7b697e26c153e11d9f2ed031fe2ca4f5 displayed.
   • Navigated to /multisig-address.
   • Entered a valid Sui public key (ABr818VXt+6PLPRoA7QnsHBfRpKJdWZPjt7ppiTl6Fkq), weight 1, and threshold 1.
   • Clicked 'Create MultiSig Address' button.
   • Successfully verified that the derived Sui MultiSig Address (0x955a4ccc5dc9c9e3fca308490733f4eb7b697e26c153e11d9f2ed031fe2ca4f5) was computed and displayed without errors.
4. S4

   Combine Signatures - Aggregate

   6 steps, 3 screenshotson-chain

   highpass

   

   

   

   • Navigated to MultiSig Combined Signature Creator page with test public keys, weights, and signature samples displayed.
   • Entered sample public key, weight 1, sample signature, and threshold 1 into the Combine Signatures form.
   • Clicked 'Combine signatures' and observed that the aggregated MultiSig address and combined signature string were generated and displayed properly.
   • MultiSig Combined Signature Creator correctly accepted the public key, weight, base64 signature, and threshold.
   • Upon clicking 'Combine signatures', the app successfully computed and displayed the Sui MultiSig Address (0xbb0ac834e948982fcdc00d8ea8716b479c1874d8f0dddf201f9d87b3d1701941) and the Sui MultiSig Combined signature string.
5. S5

   Signature Analyzer - Decode

   3 steps, 2 screenshotson-chain

   highpass

   

   

   • Navigated to /signature-analyzer and prepared test serialized signature for analysis.
   • Submitted a valid serialized signature to Signature Analyzer and verified successful decoding into scheme ED25519, public key, Sui address, and signature breakdown.
   • Navigated to /signature-analyzer.
   • Inputted a valid 97-byte base64-encoded serialized ED25519 signature into the 'Signature Bytes (base64 encoded)' field.
   • Clicked 'Analyze Signature' and observed successful breakdown: scheme (ED25519), signature public key, Sui format public key, derived Sui address (0x6f0fa4dfead22269e90aca62d63947541408feb856ddc41b446ff2e6367b720f), and signature bytes.
6. S6

   Execute Transaction - Broadcast

   5 steps, 3 screenshots

   highpass

   

   

   

   • Navigated to Execute Transaction page, selected testnet, entered base64 transaction and signature bytes, clicked Broadcast Transaction, and observed RPC Error feedback displayed.
   • Switched network selector on Execute Transaction page to 'testnet'.
   • Entered valid base64 strings for Transaction Bytes and Signature Bytes.
   • Clicked 'Broadcast Transaction', which disabled the button while initiating RPC call and displayed error feedback banner ('Error: Failed to fetch').
7. S7

   MultiSig Address - Multiple PubKeys

   5 steps, 4 screenshotson-chain

   mediumpass

   

   

   

   

   • Navigated to MultiSig Address Creator page with one initial public key input row.
   • Entered two public keys with weight 1 each and set threshold to 2.
   • Navigated to the MultiSig Address Creator page (/multisig-address).
   • Clicked 'New PubKey' button to dynamically add a second public key input row.
   • Entered two public keys ('ABr818VXt+6PLPRoA7QnsHBfRpKJdWZPjt7ppiTl6Fkq' and 'ANRdB4M6Hj73R+gRM4N6zUPNidLuatB9uccOzHBc/0bP') with weight 1 for each.
   • Set the MultiSig threshold to 2.
   • Clicked 'Create MultiSig Address' button and observed the successfully computed address '0x9134bd58a25a6b48811d1c65770dd1d01e113931ed35c13f1a3c26ed7eccf9bc' displayed under 'Sui MultiSig Address'.
8. S8

   MultiSig Address - Empty Public Key

   5 steps, 3 screenshots

   mediumpass

   

   

   

   • Navigated to MultiSig Address page where the form has fields for Sui Public Key, Weight, and threshold.
   • Left Public Key empty, set Weight to 1, and set threshold to 1.
   • Clicked 'Create MultiSig Address' with empty Public Key; the form blocked submission via HTML5 validation / did not generate an address or crash.
   • Navigated to https://multisig-toolkit.mystenlabs.com/multisig-address.
   • Left the Public Key field empty, set Weight to 1, and verified Threshold is 1.
   • Clicked 'Create MultiSig Address'; the application rejected the submission (HTML5 required field validation prevented submission of the empty public key) without crashing and without generating an address.
9. S9

   Combine Signatures - Reusable URL

   4 steps, 4 screenshots

   mediumpass

   

   

   

   

   • Navigated to the Combine MultiSig Signatures page.
   • Clicked 'Combine signatures' and verified the MultiSig address and combined signature were generated.
   • Navigated to /combine-signatures.
   • Entered public key ACaY7TW0MnPu+fr/Z2qH5YRybHsj80qfwfqiuduT4czi, weight 1, signature, and threshold 1.
   • Clicked 'Combine signatures' and observed successful generation of Sui MultiSig address and combined signature.
   • Clicked 'Generate reusable URL' and verified that a reusable URL containing the configuration query parameters was generated and copied to clipboard.
10. S10

    Combine Signatures - Required Threshold

    4 steps, 3 screenshots

    mediumpass

    

    

    

    • Navigated to Combine MultiSig Signatures page.
    • With threshold empty, clicking 'Combine signatures' does not process the form, HTML form validation halts submission for the required threshold field.
    • Navigated to the Combine MultiSig Signatures tool.
    • Entered Public Key, Weight, and Signature into the form.
    • Cleared the threshold input field to test empty threshold validation.
    • Clicked 'Combine signatures' and observed that the form was not processed, as required threshold validation prevented submission.
11. S11

    Signature Analyzer - Invalid Base64

    3 steps, 3 screenshots

    mediumpass

    

    

    

    • Navigated to Signature Analyzer page.
    • Entered invalid base64 string 'invalid_string!@#' into the Signature Bytes field.
    • Clicked Analyze Signature; an error message 'Failed to execute \'atob\' on \'Window\': The string to be decoded is not correctly encoded.' was displayed under an Error heading.
    • Signature analyzer correctly rejects invalid base64 input and displays an error message indicating decoding failed.
12. S12

    Execute Transaction - Empty Fields

    4 steps, 2 screenshots

    mediumpass

    

    

    • Navigated to Execute Transaction page, selected testnet network, leaving Transaction Bytes and Signature Bytes fields empty.
    • Clicked Broadcast Transaction with empty fields; the application displayed an error message 'Unsupported signature scheme' and did not broadcast empty payloads.
    • Selected 'testnet' on the Execute Transaction page.
    • Submitted the Broadcast Transaction form with empty Transaction Bytes and Signature Bytes.
    • The application displayed an error message 'Unsupported signature scheme' under an 'Error' header and rejected the submission without broadcasting.

Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.

lowpromoteduxF1 in S2

Raw JavaScript exception exposed in UI for invalid base64 input

Surfaced by the audit of S2, which the Tester passed, and reproduced live: I entered the non-base64 string 'non-base64-string' into the Transaction Bytes input at /offline-signer, then clicked 'Preview Effects'. An 'Error' heading appeared with the raw JavaScript error: \"Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.\"

Expected

The application displays a user-friendly validation message indicating the input must be valid base64.

Actual

The application catches and displays a raw JavaScript exception ('Failed to execute atob...') directly to the user.

3 repro steps

1. Navigate to /offline-signer.
2. Enter a non-base64 string into the Transaction Bytes input.
3. Click 'Preview Effects'.

critic-M1-1.png

These failures came from the test environment, not from the application: a credential the sandbox does not hold, a demo nobody may write to, a resource it cannot reach. They are not counted as issues.

• S6 could not exercise this: Transaction broadcast fails due to CORS policy on the RPC node. The fetch request is blocked by CORS policy, leading to a network error. The audit recorded the test environment as the cause, so it is not counted as an issue.
• S9 could not exercise this: Clipboard write permission denied when generating reusable URL. The copy action fails with a console error because the test environment denies clipboard write permissions. The audit recorded the test environment as the cause, so it is not counted as an issue.