MAINNET OFFICIAL EXTENSION REPLAY

One origin. Two paths.
Only one asks permission.

This page contrasts the documented NEAR connection flow with the exposed getTempKeyPair provider request. Nothing runs automatically, no raw key is displayed, and no result is sent off-page.

Target OKX Wallet 4.9.14 Network NEAR mainnet Mode operator-controlled

Configure

Test parameters

Selected NEAR account ID

required

Receiver contract

Allowed methods

Account exists not checked

Compare

Permission boundary

CONTROL

Documented connection

near.connect({ contractId })

Expected: OKX opens a “Connect account” permission page.

versus

EXPLOIT

Direct provider request

near.request({ method: "getTempKeyPair" })

Observed: access key is created and returned without a prompt.

I am using a disposable account and will clean up the key.

Verify

Redacted evidence

Waiting for operator action

The private key will never be rendered, copied, logged, or uploaded.

Restore

Remove the PoC key

Cleanup not yet applicable

Run the exploit first; the exact public key will appear here.

Function-call keys cannot delete themselves. Removal must be approved by the account’s full-access key. The command below targets only the key returned by this replay.

Waiting for a public key…

Session log

Local event timeline

00:00Page loaded. No wallet method called.

One origin. Two paths.Only one asks permission.