manifoldfinance / manifoldfinance/wallet_switchNetworkRpcProvider
Resolve: MetaMask chainId issue
@sambacha is already working on this.
Since Jun 4, 2022.
- Dominant language
- Go
- Stars
- 5
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/MetaMask/metamask-extension/security/advisories/GHSA-c2xw-px2x-pr65
Impact
In version 8.0.x and lower of the MetaMask extension, if a user adds a custom network to MetaMask without specifying a chain ID, MetaMask requests net_version from the network's RPC endpoint at runtime, and uses the return value to sign transactions.
This can induce the user to sign transactions for unintended chains in the following ways:
net_version returns the network ID, which may differ the chain ID. Transactions signed with a network ID could be invalid for the intended chain, and valid for another. See [EIP-155](https://eips.ethereum.org/EIPS/eip-155) for details.
A malicious or faulty endpoint could return arbitrary results for net_version at runtime.
Any user of MetaMask version 8.0.x and lower that adds or has added a custom network without specifying a chain ID is vulnerable to this attack.
Patches
Version >=8.1.0 includes https://github.com/MetaMask/metamask-extension/commit/088d4c34f112eb0f638ce99dae5c0d0958569038.
Workarounds
Update the MetaMask extension to version >=8.1.0 as soon as it's available on your platform. For most users, this will already have been done automatically.
Version >=8.1.0 requires chainId values to be specified by the user for all custom networks, and MetaMask will only use those values to sign transactions.
This is actually sort of inaccurate see https://github.com/sambacha/minimal-jsonrpc-dapp-methods/tree/master/metamask-handshake
basically , deploy an RPC contract with the chain_id opcode as a return value
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.