Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Review display of chain in signing approval popup #844

Open
chidg opened this issue Jun 15, 2023 · 1 comment
Open

Review display of chain in signing approval popup #844

chidg opened this issue Jun 15, 2023 · 1 comment
Labels
audit-fixes Fixes for complying with feedback from Chaintroopers' Audit

Comments

@chidg
Copy link
Contributor

chidg commented Jun 15, 2023

In the Chaintroopers audit they identified that we may not be fully compatible with EIP 3326 wallet_switchEthereumChain. This EIP expects that wallets which have a concept of an 'active chain' should display a confirmation to the user when the active chain is changed by the wallet_switchEthereumChain method.

This is not fully relevant to Talisman because we allow each dapp to have its own active chain. This means a dapp can't change the active chain for another dapp at a different domain, and thus mitigates the risk of a dapp changing the network maliciously or by accident. However, if a dapp calls the wallet_switchEthereumChain method, and then requests approval to sign a transaction, the user could potentially be mislead to sign a transaction on a network they didn't expect.

In order to mitigate this risk we should ensure that the current network is displayed prominently in any signing approval popups on EVM, without the user needing to click into 'details' or any other sub menu. Please review current UI and make updates if necessary.

@chidg chidg added the audit-fixes Fixes for complying with feedback from Chaintroopers' Audit label Jun 15, 2023
@chidg
Copy link
Contributor Author

chidg commented Sep 3, 2024

Still relevant, need to improve

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
audit-fixes Fixes for complying with feedback from Chaintroopers' Audit
Projects
None yet
Development

No branches or pull requests

1 participant