MetaMask / MetaMask/metamask-extension
Forbid unnamed derivation paths for snaps in stable
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Snaps can request arbitrary derivation paths via their key management permissions. We have human-readable names for some derivation paths via [`@metamask/slip44`](https://github.com/metamask/slip44), but since there are infinite derivation paths, we are going to lack names for most of them. If we don't have a legible name for a derivation path, the user cannot understand the authority granted by the permission, and the permission is unsuitable for production.
Unnamed derivation paths should be rejected in stable, but remain permitted in Flask.
Contributor guide
Research direction
Start by tracing how snap key management permissions validate derivation paths and how stable differs from Flask. Done means unnamed derivation paths are rejected in stable while remaining permitted in Flask, with the existing human-readable names still accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100