holochain-open-dev / holochain-open-dev/holoom

Assure link between evm signer and signing offer

Open
#68 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
2
Forks
2
PR merge metrics
No merged PRs in 30d

Description

Relates to https://github.com/holochain-open-dev/holoom/issues/31

## Option 1

Add a `wallet_attestation_ah` field to `EvmSigningOffer` which is validated to have the same author. Then links against an evm address can be validated against the attestation. The `evm-bytes-signer` micro-service would ensure the attestation exists on launch.

### Pros

- Simple implementation

### Cons

- (minor) Link validation requires chaining `must_get`s
- A compromised agent can freely reuse a wallet attestation; similarly a phished evm signature could be reused indefinitely

## Option 2

Nest `EvmSigningOffer` inside of a `SignedEvmSigningOffer`. The `evm-bytes-signer` micro-service then signs this offer as part of creation.

### Pros

- Knowledge that offers have been individually approved by the wallet owner

### Cons

- Slightly more work to implement
- Confusing struct name: `SignedEvmSigningOffer`

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.