MetaMask / MetaMask/metamask-extension
Allow sites to specify account properties when requesting an account.
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Some sites, like some exchanges that rely on offchain messages in the EIP 712 format, are not compatible with some hardware wallets who have not adopted those signature schemes.
This can result in dangerous situations where users deposit funds but cannot withdraw them.
The exchanges' first instinct is to request a method to detect the type of account a user has, but this has privacy issues.
Instead, this could also be solved by allowing the site to specify features the requested account is required to have at sign-in time.
For example, if we presume a `requestPermissions` method to log in:
```javascript
provider.send({
method: 'wallet_requestPermissions',
params: [
{
'eth_accounts': { mustSupportMethods: ['signTypedData_v4'] },
}
]
})
```
This could be achieved using a special caveat for [rpc-cap](https://github.com/MetaMask/json-rpc-capabilities-middleware). @rekmarks
Depends on https://ethereum-magicians.org/t/web3-login-permissions/3583
Contributor guide
Research direction
Start with the wallet_requestPermissions example and the proposed rpc-cap caveat, then review the linked Web3 Login Permissions discussion and its dependency. No implementation files or tests are named. Done would require an agreed design for requesting accounts with required capabilities such as signTypedData_v4, without detecting account types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, typescript
- Domain
- api, authentication, authorization
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100