MetaMask / MetaMask/metamask-extension
[Bug]: Signatures - Missing verification for un-used types in typed signatures
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
**Describe the bug**
In the test dapp typed v4 signature, we define a `Group` type that is not present in the signature message. This doesn't prevent the wallet for opening and signing the message successfully.
Note: having extra unused types doesn't change the signature, so it seems the impact could be low. However, this could benefit dapp developers to realize their signature messages are incorrect, if that's the case.
**Expected behavior**
When signing, throw a message like in the vid below
**Screenshots/Recordings**
See comparison:
https://github.com/user-attachments/assets/2e641bee-9be1-492b-8658-c43697d503f3
**Steps to reproduce**
1. Trigger the Signature v4 from the test dapp
2. See everything works
3. However --> inspect the code, see `Group` type is not used in the message
**Error messages or log output**
```shell
```
**Detection stage**
In production (default)
**Version**
12.9.0
**Build type**
None
**Browser**
Chrome
**Operating system**
Linux
Contributor guide
Research direction
Start with the test dapp's typed v4 signature and reproduce the case where the Group type is defined but unused in the message. Trace the signing validation entry point to determine where unused types should be detected. Done means signing this malformed message throws a clear error while valid typed signatures continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100