MetaMask / MetaMask/core

Please add `wallet_getAssets` method to `TokenController`, or silently ignore `wallet_watchAssets` if token already added

Open
#880 0 comments 2 reactions 0 assignees View on GitHub
team-assets
Dominant language
TypeScript
Stars
413
Forks
308
Avg merge
1d 4h
Merged PRs (30d)
253

Description

`TokenController` defines a function `watchAsset` which implements EIP-747's `wallet_getAssets`.

This EIP does not specify a way to determine whether a wallet already contains the given asset. This means that a dapp connecting to MetaMask cannot automatically keep suggesting their token, otherwise users are presented with the following warning the second and subsequent time `wallet_watchAssets` is called, if the user added the token the first time `wallet_watchAssets` was called:

![image](https://user-images.githubusercontent.com/97215152/180727597-db847996-c5a4-46d4-a17c-f1cdd142be82.png)

>This action will edit tokens that are already listed in your wallet, which can be used to phish you. Only approve if you are certain that you mean to change what these tokens represent. Learn more about [scams and security risks.](https://metamask.zendesk.com/hc/en-us/articles/4403988839451)

Unfortunately this warning is shown *whether or not the options submitted to `watchAsset` exactly match a token already in the wallet*.

I propose two possible solutions:

1. Add a `wallet_getAssets` RPC call that returns the four `options` (`address`, `symbol`, `decimals`, `image`) provided to `wallet_watchAssets`, for all assets registered in the wallet.
2. Silently ignore `wallet_watchAssets` calls if the wallet already includes a token whose `options` exactly match all four of the `options` provided to `wallet_watchAssets`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with TokenController and its watchAsset function, then read the EIP-747 behavior described in the issue and compare it with wallet_watchAssets. Determine whether the project should expose wallet_getAssets or ignore exact duplicate asset requests, and define completion around consistent handling of already-registered tokens and their four options.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend-api-design
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.