MetaMask / MetaMask/metamask-mobile

Protect me from custom adding "bad tokens"

Open
#2,466 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

As a user, if I don't see my token/nft appear right away, and I am manually adding a custom token, then I would like appropriate guidance (e.g., warnings, info) so I don't end up unknowingly custom adding a bad token.

Only show the tokens of this custom network in the dropdown list of 'Custom Add token'. For this, we need to find token lists for the different networks - this is not available yet.

When user tries to add a token that doesn't exist on this network, show them an error.

### More context:
DAI needs to be minted separately on different chains - they aren't equivalent, they have different token addresses. User is trusting the network when they are adding a custom token. So, Matic, xDAI, BSC all have 'DAI' (with different token addresses), so users who are trying to move DAI from 1 network to another, then you have to go via a bridge (an application that interacts with the 2 chains to make this transfer of assets).. BUT, users don't know they have to do this via a bridge (NOT MetaMask) - if they do this without bridge then users lose their money.

Bad token = malicious token (impersonating), wrong token (ensure we block the ability to add a token that doesn't exist on this chain)

Relevant context: https://twitter.com/MyCrypto/status/1369402543625932803, https://consensys.slack.com/archives/G8RSKCNCD/p1614720056085500

Contributor guide

Open the contributing guide

Research direction

Start by locating the mobile custom-token add flow and the network-specific token handling; the issue names no files or tests. Determine how token lists could be provided per network and how invalid or potentially impersonating tokens should be rejected. Done means the custom-token dropdown is network-specific and adding a token absent from that network shows an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
blockchain, react-native, typescript
Domain
blockchain, mobile-dev, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.