MetaMask / MetaMask/smart-accounts-kit
`x402DelegationProvider` can create invalid delegation chain
- Dominant language
- TypeScript
- Stars
- 63
- Forks
- 45
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 2
Description
If the `parentPermissionContext` delegates to an address other than the signing address (specified by `from` or `account.address`).
At the least we can validate the delegation chain is continuous and throw an error if it is not.
We could also do this in `encodeDelegations` utility, and / or redelegate action.
Contributor guide
Research direction
Start by tracing x402DelegationProvider and the parentPermissionContext handling; the issue also names encodeDelegations and the redelegate action as possible entry points. Verify the delegation chain remains continuous with the signing address from from or account.address, and confirm that an invalid chain produces an error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100