MetaMask / MetaMask/metamask-mobile

Confusables logic does not evaluate combinations of letters

Open
#5,415 1 comment 1 reaction 0 assignees View on GitHub
area-accessibility area-transactions needs-product observation Sev3-low team-confirmations-planning type-security usability
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### **Description**
I saw metarnask.eth was available on ENS and registered it. I notice that our confusables logic pops on the first "m". However, the confusable part of this address is the combination of "rn" masquerading as a second "m".

The unicode [confusables](https://util.unicode.org/UnicodeJsps/confusables.jsp?a=metarnask&r=None), highlights rn as the most prominent confusable character for the first "m" and on mobile our warning (first screenshot) even specifically mentions the confusability of "m" for "rn".

However, we do not highlight the actual 'rn" being used here. This is an opportunity on both extension and mobile.

### **Technical Details**

- We should look to improve the confusables logic to alert on combinations of letters.

### **Acceptance Criteria**

- When the user attempts to send to an ENS name that includes a combination of confusable characters
- Then a confusables warning should be presented
- And we should highlight the character combination that triggers the warning

Scenario: xxxx
- GIVEN a user is sending to an ENS address like metarnask.eth
- WHEN a user enters a series of characters that could be confusable
- AND a user taps 'Next" on the "Send to" page
- AND the user enters an amount and taps "Next"
- THEN the confirmation page highlights both single confusable character "m" as well as combinations like "rn"

### **References**

- Mobile screenshots v5.12.1 build 1028 with android 11 on a samsung a515f:

-Extension v 10.22.2 on mac ventura 13.0.1 with firefox 108.0.1:

Contributor guide

Open the contributing guide

Research direction

Start by locating the confusables logic used by the mobile send and confirmation flows, then reproduce the metarnask.eth case. Done means a confusables warning appears and highlights both the single-character m and the rn combination when sending to an ENS name.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.