We've designed it so it's nearly impossible in Warpcast: 

1. Frames only interact with Farcaster account keys (EdDSA keys) and never with Ethereum keys (ECDSA keys) 

2. Frames are sandboxed and can only render markup, making it very difficult to jailbreak

With everybody clicking buttons willy nilly here, is there any danger of malicious frames injecting harmful code to your device/browser?

Can frames inject malicious code into user's phone/browser?

Technowatermelon. Elder Millenial. Building Farcaster. 

nf.td/varun

@nickcherry uncovered a gnarly js issue while trying to lift same-origin restrictions on frame redirects. 

its appears unsafe to open a new browser window with an unsanitized url. 

if the url was javascript:console.log("wowow")), it executes inside the current sandbox, not the new window!

Only if you are not careful with how you handle redirects sent back by the sever

gm!
eth stakooor 🐼
delegate on optimism, arbitrum, starknet 🫡

Only if you are not careful with how you handle redirects sent back by the sever 

https://warpcast.com/v/0x033224d3

Can frames inject malicious code into user's phone/browser?

https://warpcast.com/silentjohn.eth/0x2cb857e0

/lightdotso evm chain abstraction shunkakinoki.twitter

Yes: https://docs.farcaster.xyz/reference/contracts/reference/key-registry#remove