MetaMask / MetaMask/metamask-extension
Sign-in With Ethereum (SIWE)(EIP-4361) Updates
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
# Description
Following the launch of Sign-in With Ethereum, we will update the domain binding logic, refactor code, UI/UX improvements, and fix bug(s).
EIP Spec: https://eips.ethereum.org/EIPS/eip-4361
### Concerns to address from the EIP-4361 spec:
- https://github.com/MetaMask/metamask-extension/issues/24128
```
Wallet implementers SHOULD warn users if the substring `"wants you to sign in with your Ethereum account"`
appears anywhere in an [ERC-191](https://eips.ethereum.org/EIPS/eip-191) message signing request
unless the message fully conforms to the format defined in this specification.
```
- https://github.com/MetaMask/MetaMask-planning/issues/2430
```
address REQUIRED. The Ethereum address performing the signing. Its value SHOULD be conformant to mixed-case checksum address encoding specified in [ERC-55](https://eips.ethereum.org/EIPS/eip-55) where applicable.
```
# Implementation
## 1. Domain Binding
- a) Discuss updated implementation involving security input
- Discussions happening here https://github.com/MetaMask/metamask-extension/issues/18188 and directly
cc: @bschorchit @danjm @digiwand @holantonela @legobeat @naugtur @skgbafa @wyc
- b) Communicate updates to Spruce and potential EIP-4361 spec updates
- Slack: [link](https://consensys.slack.com/archives/C031PSFHQER/p1678906690685919)
- EIP-4361 Forum: https://ethereum-magicians.org/t/eip-4361-sign-in-with-ethereum/7263/3
- c) Update domain binding logic
- Handle URL parts: URI scheme, subdomains (including `www`), and port
- Enforce the matching of URL parts when specified in the message while removing matching of URL parts when included in the origin domain, but not in the message.
- Consider Domain Binding of other EIP protocols like [EIP-6384](https://eips.ethereum.org/EIPS/eip-6384) as @holantonela suggested
- Issues:
- URI scheme: https://github.com/MetaMask/metamask-extension/issues/18188
- Subdomains (including `www`): #18332
- Port: https://github.com/MetaMask/metamask-extension/issues/18481
- PRs:
- MetaMask/core#1163
- #18518
- d) Consider adding setting to turn off domain binding which may be useful for development
- Issue: #18191
- f) Communicate changes to the community
- Issue: #18529
## 2. Code refactoring and other non-UI/UX changes
- a) Move SIWE logic to core library:
- core library: https://github.com/MetaMask/core/pull/1139
- extension: https://github.com/MetaMask/metamask-extension/pull/18409
- b) Move SIWE domain binding logic to core library:
- https://github.com/MetaMask/core/pull/1163
- c) Add e2e tests:
- https://github.com/MetaMask/metamask-extension/pull/17823
- d) clean createRPCMethodTrackingMiddleware logic and add tests:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18474
- PR: https://github.com/MetaMask/metamask-extension/pull/18008
- e) minor cleanup and add more tests:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18474
- PR: https://github.com/MetaMask/metamask-extension/pull/18230
## 3. UI/UX Changes
- a) Replace ActionableMessage with Banner Alerts:
- Issue: https://github.com/MetaMask/metamask-extension/pull/18207
- b) Replace PermissionsConnectHeader with the [newer Signature header](https://github.com/MetaMask/metamask-extension/issues/15705):
- Issue: #17812
- c) Replace the footer to align with other signature footers. Ensure we continue to require scroll before the user can sign:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18473
- d) Add bullet points for "Resources" list:
- Issue: https://github.com/MetaMask/metamask-extension/issues/18477
- From EIP-4361:
```They are expressed as RFC 3986 URIs separated by `"\n- "` where `\n` is the byte `0x0a`.```
- e) Add multiple signature support
https://github.com/MetaMask/metamask-extension/issues/17807
- f) Update SIWE confirmation page with domain binding UI
https://github.com/MetaMask/metamask-extension/issues/18622
- g) Support SIWE in mobile
https://github.com/MetaMask/MetaMask-planning/issues/1128
- h) From EIP-4361: `Wallet implementers SHOULD warn users if the substring "wants you to sign in with your Ethereum account"`
https://github.com/MetaMask/metamask-extension/issues/24128
## 4. Bug Fixes
- https://github.com/MetaMask/metamask-extension/issues/18241 (maybe fixed by domain binding subdomain update)
- https://github.com/metamask/metamask-extension/issues/17913
- https://github.com/MetaMask/metamask-extension/issues/18552
- https://github.com/MetaMask/MetaMask-planning/issues/2256
- https://github.com/MetaMask/MetaMask-planning/issues/2430
Contributor guide
Research direction
Start with the EIP-4361 specification and the linked domain-binding discussions, then inspect MetaMask/core PRs #1139 and #1163 and the referenced extension work. This umbrella issue spans domain binding, refactoring, UI/UX, tests, and bugs; completion requires selecting a scoped sub-issue and confirming its referenced behavior and tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, frontend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100