MetaMask / MetaMask/smart-accounts-kit

`x402DelegationProvider` can create invalid delegation chain

Open
#258 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
63
Forks
45
Avg merge
4d 15h
Merged PRs (30d)
2

Description

If the `parentPermissionContext` delegates to an address other than the signing address (specified by `from` or `account.address`).

At the least we can validate the delegation chain is continuous and throw an error if it is not.

We could also do this in `encodeDelegations` utility, and / or redelegate action.

Contributor guide

Open the contributing guide

Research direction

Start by tracing x402DelegationProvider and the parentPermissionContext handling; the issue also names encodeDelegations and the redelegate action as possible entry points. Verify the delegation chain remains continuous with the signing address from from or account.address, and confirm that an invalid chain produces an error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authorization
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.