MetaMask / MetaMask/metamask-mobile
Can undermine confusables logic with second payment deeplink
- Dominant language
- TypeScript
- Stars
- 3k
- Forks
- 1.7k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 669
Description
### **Description**
This was initially observed in PR 5191, but was confirmed to exist in production v5.12.1 build 1028 on android 11 and v5.12.3 build 1033 on iOS 16.
If a user engages a payment related deeplink, and without cancelling taps a second payment related deeplink to an ENS name that is expected to present confusables warning, the confusables logic is bypassed and no warning is presented.
If the user starts with a confusable address and triggers the warning, and then without cancelling taps a second payment related deeplink to an address that should not have any warning, the red exclamation mark is still presented.
### **Technical Details**
- Deeplink logic needs some love
- These specific deeplinks do not seem to be supported on extension and redirect me to download MetaMask
### **Acceptance Criteria**
- Confusable logic should be triggered even if the user doesn't cancel the first payment deeplink attempt
Scenario: Confusable address first
- GIVEN a user has tapped a payment deeplink to an address that should trigger the confusables warning
- WHEN a user clicks a second deeplink that should NOT present the confusables warning
- THEN the red exclamation mark should no longer be presented on the account icon in the "To:" field
Scenario: Confusable address second
- GIVEN a user has tapped a payment deeplink to an address that should NOT trigger the confusables warning
- WHEN a user clicks a second deeplink that should trigger the confusables warning
- THEN the red exclamation mark should be shown on the account icon
- AND the confusable characters in the "To:" address should be presented with red text
### **References**
- Deeplink that should NOT present confusables warning: https://metamask.app.link/send/pay-discord.art?value=1e13
- Deeplink that should present confusables warning: https://metamask.app.link/send/pay-munger.art?value=1e13
- Screenshots from left to right:
1. Confusable address: munger.art
2. Address that should not trigger confusables warning: discord.art
3. Confusable address first, showing red exclamation on discord.art
4. Confusable address second, showing no exclamation point and no red text in "To:" field on the letter M




Contributor guide
Research direction
Start by reproducing the issue in the mobile app with the provided payment deeplinks for munger.art and discord.art, tapping each link after the other without cancelling. Trace the deeplink entry point and confusables-warning state across both scenarios. Done means the warning, red exclamation mark, and red address text match the acceptance criteria for both link orders.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- react-native, typescript
- Domain
- mobile, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100