Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: Signatures - Passing extra data not typed is added in the signature but not visible on the UI #22900

Closed
seaona opened this issue Feb 10, 2024 · 2 comments
Labels
Sev3-low Low severity; minimal to no impact upon users stale issues and PRs marked as stale team-confirmations Push issues to confirmations team team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead type-bug

Comments

@seaona
Copy link
Contributor

seaona commented Feb 10, 2024

Describe the bug

Problem: passing extra data which is not in the typed definition, results in being it hidden in the UI but actually being signed in the signature result

Expected behavior

No response

Screenshots/Recordings

metamask-signature-type-obfuscated.mp4

Steps to reproduce

(See video)

  1. Checkout test-dapp
  2. Add an extra field in a typed 4 signature
  3. Sign it -- see the extra data is not there
  4. Copy the hash result
  5. Remove the extra field in the same signature
  6. Sign it -- copy the hash result
  7. Compare to hashes -- see they are different

Error messages or log output

No response

Version

11.9.0 but introduced earlier

Build type

None

Browser

Chrome

Operating system

Linux

Hardware wallet

No response

Additional context

No response

Severity

No response

@seaona seaona added type-bug team-confirmations-planning (only for internal use within Confirmations team) labels Feb 10, 2024
@github-project-automation github-project-automation bot moved this to To be fixed in Bugs by severity Feb 19, 2024
@bschorchit bschorchit added Sev3-low Low severity; minimal to no impact upon users team-confirmations-system DEPRECATED: please use "team-confirmations" label instead and removed team-confirmations-planning (only for internal use within Confirmations team) labels Mar 9, 2024
@matthewwalsh0 matthewwalsh0 added team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead and removed team-confirmations-system DEPRECATED: please use "team-confirmations" label instead labels Mar 18, 2024
@github-project-automation github-project-automation bot moved this to To be fixed in Bugs by team Apr 9, 2024
@cryptotavares cryptotavares added the team-confirmations Push issues to confirmations team label Apr 24, 2024
Copy link
Contributor

This issue has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 45 days if there is no further activity. The MetaMask team intends on reviewing this issue before close, and removing the stale label if it is still a bug. We welcome new comments on this issue. We do not intend on closing issues if they report bugs that are still reproducible. Thank you for your contributions.

@github-actions github-actions bot added the stale issues and PRs marked as stale label Jul 23, 2024
@jpuri
Copy link
Contributor

jpuri commented Sep 3, 2024

This is as per requirement, please check this PR: MetaMask/metamask-mobile#9795

Fields which are not typed are not part of finally signed message.

@jpuri jpuri closed this as completed Sep 3, 2024
@github-project-automation github-project-automation bot moved this from To be fixed to Fixed in Bugs by team Sep 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Sev3-low Low severity; minimal to no impact upon users stale issues and PRs marked as stale team-confirmations Push issues to confirmations team team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead type-bug
Projects
Archived in project
Development

No branches or pull requests

5 participants