MetaMask / MetaMask/eth-sig-util
Address recovery broke in 2.2.0
- Dominant language
- TypeScript
- Stars
- 583
- Forks
- 228
- Avg merge
- 11h 22m
- Merged PRs (30d)
- 7
Description
Hey there, I'm using eth-sig-util to do some signature validation on my backend. I recently redeployed the same code I had been using in a new project and found it was no longer working. This was because of an upgrade to eth-sig-util. I've gone ahead and created an example test that passes in `2.1.2`, but fails in `2.2.0`. I've narrowed it down to 0fbac013cf1da2f7bf7a7383fa18535914d279a9 as being the commit to break this. The signature and data blob here are from a real project using MetaMask v6.7.2 to do the signature.
```js
test('broken recovery', (t) => {
t.plan(1);
const data = {
"types": {
"EIP712Domain": [
{"name": "name", "type": "string"},
{"name": "version", "type": "string"},
{"name": "chainId", "type": "uint256"},
{"name": "verifyingContract", "type": "string"}
],
"authorization": [
{"name": "userid", "type": "uint256"},
{"name": "point", "type": "string"}
]
},
"domain": {
"name": "test.test",
"version": "1",
"chainId": 1,
"verifyingContract": "0x223c067f8cf28ae173ee5cafea60ca44c335fecb"
},
"primaryType": "authorization",
"message": {
"userid": 123,
"point": "~hatteb-tondys"
}
};
const sig = '0xab3b4a19d27b4f2ff9b2669888d1c3fee427b8c9ccabdeb91ef529a760aa593d00717dfa6f02d0ae0556f6c210ab5d5af41130d805d4659437d735172f7172c71c';
const expectedAddress = '0x529104532a9779ea9Eae0C1e325b3368e0F8add4';
const recoveredAddress = sigUtil.recoverTypedSignature({ data, sig });
t.equal(expectedAddress.toLowerCase(), recoveredAddress.toLocaleLowerCase());
});
```
Is this because of `verifyingContract` being misinterpreted?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the supplied `broken recovery` regression test and compare behavior between eth-sig-util 2.1.2 and 2.2.0. Inspect commit 0fbac013cf1da22f7bf7a7383fa18535914d279a9, focusing on typed-signature recovery and `verifyingContract`. Done means the test recovers the expected address for the provided MetaMask signature without regressing the earlier version's behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, cryptography
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100