TF Connect Wallet section Remains Accessible Without Password After Screen Unlock – Security Issue

[mahendravarmayadala93]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

Issue Description

A security vulnerability has been identified in the TF Connect app where the Wallet section remains accessible without requiring re-authentication after the device is locked and unlocked.

This issue was initially reported by SwissFold on Telegram for Android devices and has been verified on iOS as well. Once a user authenticates and enters the Wallet section, locking and unlocking the mobile device does not trigger any password or authentication prompt, allowing unauthorized access if the device is compromised.

This behavior poses a potential security risk, as sensitive wallet information remains exposed without proper session re-validation.

Steps To Reproduce

1. Open the TF Connect app.
2. Navigate to the Wallet section by entering the password.
3. Lock the mobile device screen.
4. Unlock the device.
5. Observe that the Wallet section is still accessible without prompting for a password.

Relevant screenshots/screen records

(https://drive.google.com/file/d/1wqiTC91b-4puU-avAlmlfziIUjULlBgl/view?usp=sharing)

Relevant log output

NA