holochain-open-dev / holochain-open-dev/holoom
Assure link between evm signer and signing offer
- Dominant language
- TypeScript
- Stars
- 2
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Relates to https://github.com/holochain-open-dev/holoom/issues/31
## Option 1
Add a `wallet_attestation_ah` field to `EvmSigningOffer` which is validated to have the same author. Then links against an evm address can be validated against the attestation. The `evm-bytes-signer` micro-service would ensure the attestation exists on launch.
### Pros
- Simple implementation
### Cons
- (minor) Link validation requires chaining `must_get`s
- A compromised agent can freely reuse a wallet attestation; similarly a phished evm signature could be reused indefinitely
## Option 2
Nest `EvmSigningOffer` inside of a `SignedEvmSigningOffer`. The `evm-bytes-signer` micro-service then signs this offer as part of creation.
### Pros
- Knowledge that offers have been individually approved by the wallet owner
### Cons
- Slightly more work to implement
- Confusing struct name: `SignedEvmSigningOffer`
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.