MetaMask / MetaMask/metamask-mobile
Protect me from custom adding "bad tokens"
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
As a user, if I don't see my token/nft appear right away, and I am manually adding a custom token, then I would like appropriate guidance (e.g., warnings, info) so I don't end up unknowingly custom adding a bad token.
Only show the tokens of this custom network in the dropdown list of 'Custom Add token'. For this, we need to find token lists for the different networks - this is not available yet.
When user tries to add a token that doesn't exist on this network, show them an error.
### More context:
DAI needs to be minted separately on different chains - they aren't equivalent, they have different token addresses. User is trusting the network when they are adding a custom token. So, Matic, xDAI, BSC all have 'DAI' (with different token addresses), so users who are trying to move DAI from 1 network to another, then you have to go via a bridge (an application that interacts with the 2 chains to make this transfer of assets).. BUT, users don't know they have to do this via a bridge (NOT MetaMask) - if they do this without bridge then users lose their money.
Bad token = malicious token (impersonating), wrong token (ensure we block the ability to add a token that doesn't exist on this chain)
Relevant context: https://twitter.com/MyCrypto/status/1369402543625932803, https://consensys.slack.com/archives/G8RSKCNCD/p1614720056085500
Contributor guide
Research direction
Start by locating the mobile custom-token add flow and the network-specific token handling; the issue names no files or tests. Determine how token lists could be provided per network and how invalid or potentially impersonating tokens should be rejected. Done means the custom-token dropdown is network-specific and adding a token absent from that network shows an error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- blockchain, react-native, typescript
- Domain
- blockchain, mobile-dev, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100