MetaMask / MetaMask/metamask-extension

Sign-in With Ethereum (SIWE)(EIP-4361) Updates

Open
#18,471 1 comment 0 reactions 0 assignees View on GitHub
epic INVALID-ISSUE-TEMPLATE team-confirmations-planning
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

# Description

Following the launch of Sign-in With Ethereum, we will update the domain binding logic, refactor code, UI/UX improvements, and fix bug(s).

EIP Spec: https://eips.ethereum.org/EIPS/eip-4361

### Concerns to address from the EIP-4361 spec:
- https://github.com/MetaMask/metamask-extension/issues/24128
```
Wallet implementers SHOULD warn users if the substring `"wants you to sign in with your Ethereum account"`
appears anywhere in an [ERC-191](https://eips.ethereum.org/EIPS/eip-191) message signing request
unless the message fully conforms to the format defined in this specification.
```

- https://github.com/MetaMask/MetaMask-planning/issues/2430
```
address REQUIRED. The Ethereum address performing the signing. Its value SHOULD be conformant to mixed-case checksum address encoding specified in [ERC-55](https://eips.ethereum.org/EIPS/eip-55) where applicable.
```


# Implementation

## 1. Domain Binding
- a) Discuss updated implementation involving security input
- Discussions happening here https://github.com/MetaMask/metamask-extension/issues/18188 and directly
cc: @bschorchit @danjm @digiwand @holantonela @legobeat @naugtur @skgbafa @wyc
- b) Communicate updates to Spruce and potential EIP-4361 spec updates
- Slack: [link](https://consensys.slack.com/archives/C031PSFHQER/p1678906690685919)
- EIP-4361 Forum: https://ethereum-magicians.org/t/eip-4361-sign-in-with-ethereum/7263/3
- c) Update domain binding logic
- Handle URL parts: URI scheme, subdomains (including `www`), and port
- Enforce the matching of URL parts when specified in the message while removing matching of URL parts when included in the origin domain, but not in the message.
- Consider Domain Binding of other EIP protocols like [EIP-6384](https://eips.ethereum.org/EIPS/eip-6384) as @holantonela suggested
- Issues:
- URI scheme: https://github.com/MetaMask/metamask-extension/issues/18188
- Subdomains (including `www`): #18332
- Port: https://github.com/MetaMask/metamask-extension/issues/18481
- PRs:
- MetaMask/core#1163
- #18518
- d) Consider adding setting to turn off domain binding which may be useful for development
- Issue: #18191
- f) Communicate changes to the community
- Issue: #18529

## 2. Code refactoring and other non-UI/UX changes
- a) Move SIWE logic to core library:
- core library: https://github.com/MetaMask/core/pull/1139
- extension: https://github.com/MetaMask/metamask-extension/pull/18409
- b) Move SIWE domain binding logic to core library:
- https://github.com/MetaMask/core/pull/1163
- c) Add e2e tests:
- https://github.com/MetaMask/metamask-extension/pull/17823
- d) clean createRPCMethodTrackingMiddleware logic and add tests:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18474
- PR: https://github.com/MetaMask/metamask-extension/pull/18008
- e) minor cleanup and add more tests:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18474
- PR: https://github.com/MetaMask/metamask-extension/pull/18230

## 3. UI/UX Changes
- a) Replace ActionableMessage with Banner Alerts:
- Issue: https://github.com/MetaMask/metamask-extension/pull/18207
- b) Replace PermissionsConnectHeader with the [newer Signature header](https://github.com/MetaMask/metamask-extension/issues/15705):
- Issue: #17812
- c) Replace the footer to align with other signature footers. Ensure we continue to require scroll before the user can sign:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18473
- d) Add bullet points for "Resources" list:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18477
- From EIP-4361:
```They are expressed as RFC 3986 URIs separated by `"\n- "` where `\n` is the byte `0x0a`.```
- e) Add multiple signature support
https://github.com/MetaMask/metamask-extension/issues/17807
- f) Update SIWE confirmation page with domain binding UI
https://github.com/MetaMask/metamask-extension/issues/18622
- g) Support SIWE in mobile
https://github.com/MetaMask/MetaMask-planning/issues/1128
- h) From EIP-4361: `Wallet implementers SHOULD warn users if the substring "wants you to sign in with your Ethereum account"`
https://github.com/MetaMask/metamask-extension/issues/24128

## 4. Bug Fixes
- https://github.com/MetaMask/metamask-extension/issues/18241 (maybe fixed by domain binding subdomain update)
- https://github.com/metamask/metamask-extension/issues/17913
- https://github.com/MetaMask/metamask-extension/issues/18552
- https://github.com/MetaMask/MetaMask-planning/issues/2256
- https://github.com/MetaMask/MetaMask-planning/issues/2430

Contributor guide

Open the contributing guide

Research direction

Start with the EIP-4361 specification and the linked domain-binding discussions, then inspect MetaMask/core PRs #1139 and #1163 and the referenced extension work. This umbrella issue spans domain binding, refactoring, UI/UX, tests, and bugs; completion requires selecting a scoped sub-issue and confirming its referenced behavior and tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, frontend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.