MetaMask / MetaMask/metamask-mobile

Can undermine confusables logic with second payment deeplink

Open
#5,417 0 comments 1 reaction 0 assignees View on GitHub
area-transactions deeplink Sev3-low team-confirmations-planning type-bug type-security
Dominant language
TypeScript
Stars
3k
Forks
1.7k
Avg merge
1d 14h
Merged PRs (30d)
669

Description

### **Description**

This was initially observed in PR 5191, but was confirmed to exist in production v5.12.1 build 1028 on android 11 and v5.12.3 build 1033 on iOS 16.

If a user engages a payment related deeplink, and without cancelling taps a second payment related deeplink to an ENS name that is expected to present confusables warning, the confusables logic is bypassed and no warning is presented.

If the user starts with a confusable address and triggers the warning, and then without cancelling taps a second payment related deeplink to an address that should not have any warning, the red exclamation mark is still presented.

### **Technical Details**

- Deeplink logic needs some love
- These specific deeplinks do not seem to be supported on extension and redirect me to download MetaMask

### **Acceptance Criteria**

- Confusable logic should be triggered even if the user doesn't cancel the first payment deeplink attempt

Scenario: Confusable address first
- GIVEN a user has tapped a payment deeplink to an address that should trigger the confusables warning
- WHEN a user clicks a second deeplink that should NOT present the confusables warning
- THEN the red exclamation mark should no longer be presented on the account icon in the "To:" field

Scenario: Confusable address second
- GIVEN a user has tapped a payment deeplink to an address that should NOT trigger the confusables warning
- WHEN a user clicks a second deeplink that should trigger the confusables warning
- THEN the red exclamation mark should be shown on the account icon
- AND the confusable characters in the "To:" address should be presented with red text

### **References**

- Deeplink that should NOT present confusables warning: https://metamask.app.link/send/pay-discord.art?value=1e13
- Deeplink that should present confusables warning: https://metamask.app.link/send/pay-munger.art?value=1e13

- Screenshots from left to right:
1. Confusable address: munger.art
2. Address that should not trigger confusables warning: discord.art
3. Confusable address first, showing red exclamation on discord.art
4. Confusable address second, showing no exclamation point and no red text in "To:" field on the letter M

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue in the mobile app with the provided payment deeplinks for munger.art and discord.art, tapping each link after the other without cancelling. Trace the deeplink entry point and confusables-warning state across both scenarios. Done means the warning, red exclamation mark, and red address text match the acceptance criteria for both link orders.

Written by the indexing model from the issue text.

Assessment

Tech stack
react-native, typescript
Domain
mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.