MetaMask / MetaMask/metamask-extension
Ensure signTypedData is restricted to a domain
Open
area-signTypedData
area-transactions
team-confirmations-planning
type-enhancement
type-security
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
EIP712 has a `domain` field that is meant to be used as a security measure, to restrict the range of possible signatures.
We do not currently enforce `domain` in any way that could prove to a contract that a signature was suggested to the wallet from a given web app.
This has been requested by an L2 team using `signTypedData`.
Contributor guide
Research direction
Start by tracing the signTypedData entry point and how EIP712 domain data is currently handled. Determine the intended enforcement behavior with the relevant contract and L2 use case; done means signatures can be proven to have been suggested to the wallet by the specified web app.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100