MetaMask / MetaMask/eth-sig-util

Address recovery broke in 2.2.0

Open
#56 4 comments 3 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
583
Forks
228
Avg merge
11h 22m
Merged PRs (30d)
7

Description

Hey there, I'm using eth-sig-util to do some signature validation on my backend. I recently redeployed the same code I had been using in a new project and found it was no longer working. This was because of an upgrade to eth-sig-util. I've gone ahead and created an example test that passes in `2.1.2`, but fails in `2.2.0`. I've narrowed it down to 0fbac013cf1da2f7bf7a7383fa18535914d279a9 as being the commit to break this. The signature and data blob here are from a real project using MetaMask v6.7.2 to do the signature.

```js
test('broken recovery', (t) => {
t.plan(1);
const data = {
"types": {
"EIP712Domain": [
{"name": "name", "type": "string"},
{"name": "version", "type": "string"},
{"name": "chainId", "type": "uint256"},
{"name": "verifyingContract", "type": "string"}
],
"authorization": [
{"name": "userid", "type": "uint256"},
{"name": "point", "type": "string"}
]
},
"domain": {
"name": "test.test",
"version": "1",
"chainId": 1,
"verifyingContract": "0x223c067f8cf28ae173ee5cafea60ca44c335fecb"
},
"primaryType": "authorization",
"message": {
"userid": 123,
"point": "~hatteb-tondys"
}
};
const sig = '0xab3b4a19d27b4f2ff9b2669888d1c3fee427b8c9ccabdeb91ef529a760aa593d00717dfa6f02d0ae0556f6c210ab5d5af41130d805d4659437d735172f7172c71c';
const expectedAddress = '0x529104532a9779ea9Eae0C1e325b3368e0F8add4';

const recoveredAddress = sigUtil.recoverTypedSignature({ data, sig });
t.equal(expectedAddress.toLowerCase(), recoveredAddress.toLocaleLowerCase());
});
```

Is this because of `verifyingContract` being misinterpreted?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the supplied `broken recovery` regression test and compare behavior between eth-sig-util 2.1.2 and 2.2.0. Inspect commit 0fbac013cf1da22f7bf7a7383fa18535914d279a9, focusing on typed-signature recovery and `verifyingContract`. Done means the test recovers the expected address for the provided MetaMask signature without regressing the earlier version's behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
blockchain, cryptography
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.