MetaMask / MetaMask/metamask-extension

[Bug]: Signatures - Missing verification for un-used types in typed signatures

Open
#29,155 0 comments 0 reactions 0 assignees View on GitHub
INVALID-ISSUE-TEMPLATE Signatures T08-featureRequest team-confirmations type-enhancement
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

**Describe the bug**

In the test dapp typed v4 signature, we define a `Group` type that is not present in the signature message. This doesn't prevent the wallet for opening and signing the message successfully.

Note: having extra unused types doesn't change the signature, so it seems the impact could be low. However, this could benefit dapp developers to realize their signature messages are incorrect, if that's the case.

**Expected behavior**

When signing, throw a message like in the vid below

**Screenshots/Recordings**

See comparison:

https://github.com/user-attachments/assets/2e641bee-9be1-492b-8658-c43697d503f3

**Steps to reproduce**

1. Trigger the Signature v4 from the test dapp
2. See everything works
3. However --> inspect the code, see `Group` type is not used in the message

**Error messages or log output**

```shell

```

**Detection stage**

In production (default)

**Version**

12.9.0

**Build type**

None

**Browser**

Chrome

**Operating system**

Linux

Contributor guide

Open the contributing guide

Research direction

Start with the test dapp's typed v4 signature and reproduce the case where the Group type is defined but unused in the message. Trace the signing validation entry point to determine where unused types should be detected. Done means signing this malformed message throws a clear error while valid typed signatures continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
blockchain, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.