[HIGH] Seed phrase is stored in plaintext in IndexedDB; there is no wallet password or unlock screen

Summary

The app never passes password to Sphere.init/create/import (SphereProvider.createWallet L495-501, importWallet L558-564). The SDK supports at-rest encryption (encrypt(data){ if(!this._password) return data; ... }) but without a password it stores the mnemonic verbatim, and there is no lock/unlock screen anywhere — the wallet is fully open on page load. Anyone with local machine / browser-profile access reads the seed.

Where

src/sdk/SphereProvider.tsx:495.

Note

This is purely an app decision — the SDK already exposes the password option; the app simply does not use it. No SDK change required.

Fix

Offer an optional (ideally required) wallet password during onboarding and thread it through Sphere.init/import; add an unlock screen that gates decryption on load. Decide UX for existing plaintext wallets (prompt to set a password → re-encrypt).

Found by multi-agent audit @ main b477d4d7; adversarially verified.