manifoldfinance / manifoldfinance/wallet_switchNetworkRpcProvider

Resolve: MetaMask chainId issue

Open
#14 0 comments 0 reactions 1 assignee View on GitHub

@sambacha is already working on this.

Since Jun 4, 2022.

bug
Dominant language
Go
Stars
5
Forks
0
PR merge metrics
No merged PRs in 30d

Description

https://github.com/MetaMask/metamask-extension/security/advisories/GHSA-c2xw-px2x-pr65

Impact
In version 8.0.x and lower of the MetaMask extension, if a user adds a custom network to MetaMask without specifying a chain ID, MetaMask requests net_version from the network's RPC endpoint at runtime, and uses the return value to sign transactions.

This can induce the user to sign transactions for unintended chains in the following ways:

net_version returns the network ID, which may differ the chain ID. Transactions signed with a network ID could be invalid for the intended chain, and valid for another. See [EIP-155](https://eips.ethereum.org/EIPS/eip-155) for details.
A malicious or faulty endpoint could return arbitrary results for net_version at runtime.
Any user of MetaMask version 8.0.x and lower that adds or has added a custom network without specifying a chain ID is vulnerable to this attack.

Patches
Version >=8.1.0 includes https://github.com/MetaMask/metamask-extension/commit/088d4c34f112eb0f638ce99dae5c0d0958569038.

Workarounds
Update the MetaMask extension to version >=8.1.0 as soon as it's available on your platform. For most users, this will already have been done automatically.
Version >=8.1.0 requires chainId values to be specified by the user for all custom networks, and MetaMask will only use those values to sign transactions.

This is actually sort of inaccurate see https://github.com/sambacha/minimal-jsonrpc-dapp-methods/tree/master/metamask-handshake

basically , deploy an RPC contract with the chain_id opcode as a return value

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.