OpenBurner v1.4.0 - Security Hardening & Faster Loads

Card & Signature Checks

• Card keys must be exactly a valid secp256k1 public key — a malformed key now ends the connection instead of being padded into an address nobody controls
• Every transaction, message and typed-data signature must recover to the card you connected before it's broadcast or handed to a dApp
• Signing always uses the connected card's key slot; sessions saved before this release are asked to reconnect once

Locked-Down API

• The pricing, swap and NFT proxies only answer the app's own origin and send no CORS headers
• Every request is validated, and the CoinGecko proxy only allows the endpoints the app uses
• Optional Upstash-backed rate limits and DAILY_CAP_* caps per upstream key (see docs/HOSTING.md)
• No keys, signatures, pairing links or PINs are logged; a Debug logging switch in Settings helps support sessions

Faster Loading

• First load drops from 969 kB to 111 kB — WalletConnect, the card libraries and each connect screen load only when needed
• One multicall for native and token balances, shared RPC providers, and batched price lookups

Clearer Transactions

• A review step shows recipient, amount, network and estimated fee before you tap; Max keeps a gas reserve
• Failed and still-pending transactions are shown as they are, not as "complete"
• Correct swap minimum received, and the approval flow no longer gets stuck

Fixes & Improvements

• Refresh reloads token balances, and balances update after every send and swap
• An RPC outage no longer looks like an empty wallet; mobile NFC cancel no longer spins forever
• Desktop pairing shows each stage and any errors, with a fresh-QR option
• Accessible modals (Escape, focus, scroll lock), toasts above modals, Unichain on mainnet
• Next.js 15.5 + React 19, ethers 6.17, libhalo 1.20, WalletConnect 2.26 — production npm audit is clean

Note: If you self-host, set the new optional variables in env.example. Your own deployment's origin is always allowed; ALLOWED_ORIGINS is only for additional origins.