MetaMask / MetaMask/metamask-extension

Support domain mismatch on SIWE on development mode

Open
#18,191 1 comment 0 reactions 2 assignees Claimed by @jiexi View on GitHub
team-wallet-api-platform-deprecated
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

Originally reported here: https://github.com/MetaMask/metamask-extension/issues/17707#issuecomment-1470877080

As we've added support for SIWE, we have blocked users from signing messages with domain mismatch for security reasons - preventing phishing attacks as proposed in the SIWE spec.
Although this was the correct decision on the user facing side, we might have made developers work a lot more complicated with this change (see link above).

Therefore, while we should not make changes on the end user side (as allowing for domain mismatch would reintroduce the phishing attack vector), we could enable developers to workaround this block in order to facilitate their work.

Adding a toggle in advanced settings and communicate the existence of it through the error thrown in console (similar to what we currently do for eth_sign https://github.com/MetaMask/metamask-extension/pull/17308) could be a potential a solution for this. But the DevEx team is best suited to propose the ideal solution here.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.