New Feature Request: Hook to intercept signTypedData/PersonalSign of structured data (gasless tx) #1165
ethereumdegen
started this conversation in
Ideas
Replies: 1 comment
-
Please see this PR requesting the same feature: PR #1024 |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Hello,
In light of the recent hack on Kevin Rose's wallet, analysis of the attack and of the vast majority of recent crypto wallet attacks shows that the primary attack vector is actually via the 'signTypedData' or 'personalSign' feature of metamask.
Therefore, I am trying to build a snap that intercepts the 'signTypedData' window rendering so that instead of showing the raw hex code data of the typedData, it could still show that but also show a rendering of icons and images and other very obvious contextual clues and warnings about what the signTypedData truly represents. If you look at the 'JoinFire' wallet (competitor to metamask) they are doing this: providing a better rendering representation of what signTypedData is signing using images and high-tech static analysis.
I think this is important as it would allow us (me) to build snaps that help show more context for someone doing a signTypedData and prevent another kevin rose incident. All i think I would need to build a snap like this for there to be a hook that is called upon the trigger of a user requesting to do signTypedData. Then the snap could send that typed data payload to a third party server (snap server) which would do static analysis and return a render payload of images and other more human-readable contextual information. Of course there could be another tab that still showed the raw signTypedData payload as well.
To elaborate, i see there is a hook[export] named ' onTransaction' which allows for providing better contextual information for a normal transaction. However I could be mistaken but I do not see an export for 'onSignTypedData' or 'onPersonalSign' or something along those lines. That is what I am requesting.
Beta Was this translation helpful? Give feedback.
All reactions