[Bug]: Confirmations - Malicious Address is not checksummed

Open

#26,750 opened on Mar 2, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bugs---Low-Priority INVALID-ISSUE-TEMPLATE regression-RC-7.68.0 Sev2-normal team-confirmations type-bug

Dominant language: TypeScript
Stars: 3k
Forks: 1.7k
Avg merge: 1d 14h
Merged PRs (30d): 669

Description

**Describe the bug**

Malicious Address is not checksummed when we see the address details

**Screenshots/Recordings**

https://github.com/user-attachments/assets/489f4dfb-b6d0-4332-a55a-bc40cdc442d7

**Steps to reproduce**

1. Go to the test dapp
2. Connect
3. Click Send Malicious ETH
4. Click Advanced details
5. Click Malicious address
6. See address

**Error messages or log output**

```shell

```

**Where was this bug found?**

Internal release testing

**Version**

7.68.0 (possibly in prod too)

**Build number**

3837

**Build type**

None

**Device**

Pixel 6

**Operating system**

Android

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Research direction

Reproduce the flow in the test dapp: connect, choose Send Malicious ETH, open Advanced details, and select Malicious address. Inspect the confirmation address-details entry point and compare the displayed address with the expected checksummed form; done means the malicious address is shown with correct checksum casing on Android.

Written by the indexing model from the issue text.

Assessment

Tech stack: react-native, typescript
Domain: mobile, security
Issue type: Bug
Difficulty: 3/5
Estimated time: 1-2 days
Activity status: Stale
Clarity: Mostly clear
Newbie friendliness: 45/100