MetaMask / MetaMask/metamask-mobile
Confusables logic does not evaluate combinations of letters
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### **Description**
I saw metarnask.eth was available on ENS and registered it. I notice that our confusables logic pops on the first "m". However, the confusable part of this address is the combination of "rn" masquerading as a second "m".
The unicode [confusables](https://util.unicode.org/UnicodeJsps/confusables.jsp?a=metarnask&r=None), highlights rn as the most prominent confusable character for the first "m" and on mobile our warning (first screenshot) even specifically mentions the confusability of "m" for "rn".
However, we do not highlight the actual 'rn" being used here. This is an opportunity on both extension and mobile.
### **Technical Details**
- We should look to improve the confusables logic to alert on combinations of letters.
### **Acceptance Criteria**
- When the user attempts to send to an ENS name that includes a combination of confusable characters
- Then a confusables warning should be presented
- And we should highlight the character combination that triggers the warning
Scenario: xxxx
- GIVEN a user is sending to an ENS address like metarnask.eth
- WHEN a user enters a series of characters that could be confusable
- AND a user taps 'Next" on the "Send to" page
- AND the user enters an amount and taps "Next"
- THEN the confirmation page highlights both single confusable character "m" as well as combinations like "rn"
### **References**
- Mobile screenshots v5.12.1 build 1028 with android 11 on a samsung a515f:


-Extension v 10.22.2 on mac ventura 13.0.1 with firefox 108.0.1:


Contributor guide
Research direction
Start by locating the confusables logic used by the mobile send and confirmation flows, then reproduce the metarnask.eth case. Done means a confusables warning appears and highlights both the single-character m and the rn combination when sending to an ENS name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100