Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add PPOM testing section #253

Merged
merged 8 commits into from
Aug 30, 2023
Merged

Add PPOM testing section #253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
5ac25b9
ppom draft transactions
seaona Aug 18, 2023
85e7a88
ppom section
seaona Aug 18, 2023
222d3dc
Merge branch 'main' into ppom
seaona Aug 18, 2023
27009c6
ser account 0 on the permit message
seaona Aug 18, 2023
cafa50a
Updated tx data
seaona Aug 24, 2023
cc6becb
Updated tx's and fix lint
seaona Aug 24, 2023
c39fcaa
Update func names
seaona Aug 30, 2023
135e964
Siwe cleanup
seaona Aug 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions src/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -614,6 +614,64 @@ <h4 class="card-title">
</div>
</section>

<section>
<div class="row">
<div
class="col-xl-4 col-lg-6 col-md-12 col-sm-12 col-12 d-flex align-items-stretch"
>
<div class="card full-width">
<div class="card-body">
<h4 class="card-title">
PPOM
</h4>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousRawEthButton"
disabled
>
Malicious Eth Transfer
</button>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousERC20TransferButton"
disabled
>
Malicious ERC20 Transfer
</button>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousApprovalButton"
disabled
>
Malicious ERC20 Approval
</button>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousPermit"
disabled
>
Malicious Permit
</button>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousTradeOrder"
disabled
>
Malicious Trade Order
</button>
<button
class="btn btn-primary btn-lg btn-block mb-3"
id="maliciousSeaport"
disabled
>
Malicious Seaport
</button>
</div>
</div>
</div>
</div>
</section>

<section>
<div class="row d-flex justify-content-center">
<div class="col-xl-4 col-lg-6 col-md-12 col-sm-12 col-12">
Expand Down
117 changes: 115 additions & 2 deletions src/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,6 +220,18 @@ const submitFormButton = document.getElementById('submitForm');
const addEthereumChain = document.getElementById('addEthereumChain');
const switchEthereumChain = document.getElementById('switchEthereumChain');

// PPOM
const maliciousApprovalButton = document.getElementById(
'maliciousApprovalButton',
);
const maliciousERC20TransferButton = document.getElementById(
'maliciousERC20TransferButton',
);
const maliciousRawEthButton = document.getElementById('maliciousRawEthButton');
const maliciousPermit = document.getElementById('maliciousPermit');
const maliciousTradeOrder = document.getElementById('maliciousTradeOrder');
const maliciousSeaport = document.getElementById('maliciousSeaport');

const initialize = async () => {
try {
// We must specify the network as 'any' for ethers to allow network changes
Expand Down Expand Up @@ -356,6 +368,12 @@ const initialize = async () => {
siweBadAccount,
siweMalformed,
eip747WatchButton,
maliciousApprovalButton,
maliciousERC20TransferButton,
maliciousRawEthButton,
maliciousPermit,
maliciousTradeOrder,
maliciousSeaport,
];

mintButton.disabled = false;
Expand Down Expand Up @@ -420,6 +438,12 @@ const initialize = async () => {
siweBadAccount.disabled = false;
siweMalformed.disabled = false;
eip747WatchButton.disabled = false;
maliciousApprovalButton.disabled = false;
maliciousERC20TransferButton.disabled = false;
maliciousRawEthButton.disabled = false;
maliciousPermit.disabled = false;
maliciousTradeOrder.disabled = false;
maliciousSeaport.disabled = false;
}

if (isMetaMaskInstalled()) {
Expand Down Expand Up @@ -954,6 +978,95 @@ const initialize = async () => {
}
};

/**
* PPOM
*/

// Malicious ERC20 Approval
maliciousApprovalButton.onclick = async () => {
const result = await ethereum.request({
method: 'eth_sendTransaction',
params: [
{
from: accounts[0],
to: '0x4fabb145d64652a948d72533023f6e7a623c7c53',
gas: '0x30d40',
data: '0x095ea7b3000000000000000000000000e50a2dbc466d01a34c3e8b7e8e45fce4f7da39e6000000000000000000000000000000000000000000000000ffffffffffffffff',
gasPrice: '0x76c3b0342',
},
],
});
console.log(result);
};

// Malicious ERC20 transfer
maliciousERC20TransferButton.onclick = async () => {
const result = await ethereum.request({
method: 'eth_sendTransaction',
params: [
{
from: accounts[0],
to: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
gas: '0x30d40',
data: '0xa9059cbb0000000000000000000000005fbdb2315678afecb367f032d93f642f64180aa30000000000000000000000000000000000000000000000000000000000000064',
gasPrice: '0x76c3b0342',
},
],
});
console.log(result);
};

// Malicious raw ETH transfer
maliciousRawEthButton.onclick = async () => {
const result = await ethereum.request({
method: 'eth_sendTransaction',
params: [
{
from: accounts[0],
to: '0x5FbDB2315678afecb367f032d93F642f64180aa3',
value: '0x9184e72a000',
},
],
});
console.log(result);
};

// Malicious permit
maliciousPermit.onclick = async () => {
const result = await ethereum.request({
method: 'eth_signTypedData_v4',
params: [
accounts[0],
`{"types":{"EIP712Domain":[{"name":"name","type":"string"},{"name":"version","type":"string"},{"name":"chainId","type":"uint256"},{"name":"verifyingContract","type":"address"}],"Permit":[{"name":"owner","type":"address"},{"name":"spender","type":"address"},{"name":"value","type":"uint256"},{"name":"nonce","type":"uint256"},{"name":"deadline","type":"uint256"}]},"primaryType":"Permit","domain":{"name":"USD Coin","verifyingContract":"0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48","chainId":1,"version":"2"},"message":{"owner":"${accounts[0]}","spender":"0x1661F1B207629e4F385DA89cFF535C8E5Eb23Ee3","value":"1033366316628","nonce":1,"deadline":1678709555}}`,
],
});
console.log(result);
};

// Malicious trade order
maliciousTradeOrder.onclick = async () => {
const result = await ethereum.request({
method: 'eth_signTypedData_v4',
params: [
accounts[0],
`{"types":{"ERC721Order":[{"type":"uint8","name":"direction"},{"type":"address","name":"maker"},{"type":"address","name":"taker"},{"type":"uint256","name":"expiry"},{"type":"uint256","name":"nonce"},{"type":"address","name":"erc20Token"},{"type":"uint256","name":"erc20TokenAmount"},{"type":"Fee[]","name":"fees"},{"type":"address","name":"erc721Token"},{"type":"uint256","name":"erc721TokenId"},{"type":"Property[]","name":"erc721TokenProperties"}],"Fee":[{"type":"address","name":"recipient"},{"type":"uint256","name":"amount"},{"type":"bytes","name":"feeData"}],"Property":[{"type":"address","name":"propertyValidator"},{"type":"bytes","name":"propertyData"}],"EIP712Domain":[{"name":"name","type":"string"},{"name":"version","type":"string"},{"name":"chainId","type":"uint256"},{"name":"verifyingContract","type":"address"}]},"domain":{"name":"ZeroEx","version":"1.0.0","chainId":"1","verifyingContract":"0xdef1c0ded9bec7f1a1670819833240f027b25eff"},"primaryType":"ERC721Order","message":{"direction":"0","maker":"${accounts[0]}","taker":"0x0000000000000000000000000000000000000000","expiry":"2524604400","nonce":"100131415900000000000000000000000000000083840314483690155566137712510085002484","erc20Token":"0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2","erc20TokenAmount":"42000000000000","fees":[],"erc721Token":"0x8a90CAb2b38dba80c64b7734e58Ee1dB38B8992e","erc721TokenId":"2516","erc721TokenProperties":[]}}`,
],
});
console.log(result);
};

// Malicious Seaport
maliciousSeaport.onclick = async () => {
const result = await ethereum.request({
method: 'eth_signTypedData_v4',
params: [
accounts[0],
'{"types":{"OrderComponents":[{"name":"offerer","type":"address"},{"name":"zone","type":"address"},{"name":"offer","type":"OfferItem[]"},{"name":"consideration","type":"ConsiderationItem[]"},{"name":"orderType","type":"uint8"},{"name":"startTime","type":"uint256"},{"name":"endTime","type":"uint256"},{"name":"zoneHash","type":"bytes32"},{"name":"salt","type":"uint256"},{"name":"conduitKey","type":"bytes32"},{"name":"counter","type":"uint256"}],"OfferItem":[{"name":"itemType","type":"uint8"},{"name":"token","type":"address"},{"name":"identifierOrCriteria","type":"uint256"},{"name":"startAmount","type":"uint256"},{"name":"endAmount","type":"uint256"}],"ConsiderationItem":[{"name":"itemType","type":"uint8"},{"name":"token","type":"address"},{"name":"identifierOrCriteria","type":"uint256"},{"name":"startAmount","type":"uint256"},{"name":"endAmount","type":"uint256"},{"name":"recipient","type":"address"}],"EIP712Domain":[{"name":"name","type":"string"},{"name":"version","type":"string"},{"name":"chainId","type":"uint256"},{"name":"verifyingContract","type":"address"}]},"domain":{"name":"Seaport","version":"1.1","chainId":"1","verifyingContract":"0x00000000006c3852cbef3e08e8df289169ede581"},"primaryType":"OrderComponents","message":{"offerer":"0x5a6f5477bdeb7801ba137a9f0dc39c0599bac994","zone":"0x004c00500000ad104d7dbd00e3ae0a5c00560c00","offer":[{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"26464","startAmount":"1","endAmount":"1"},{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"7779","startAmount":"1","endAmount":"1"},{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"4770","startAmount":"1","endAmount":"1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"9594","startAmount":"1","endAmount":"1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"2118","startAmount":"1","endAmount":"1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"1753","startAmount":"1","endAmount":"1"}],"consideration":[{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"26464","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"},{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"7779","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"},{"itemType":"2","token":"0x60e4d786628fea6478f785a6d7e704777c86a7c6","identifierOrCriteria":"4770","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"9594","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"2118","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"},{"itemType":"2","token":"0xba30e5f9bb24caa003e9f2f0497ad287fdf95623","identifierOrCriteria":"1753","startAmount":"1","endAmount":"1","recipient":"0xdfdc0b1cf8e9950d6a860af6501c4fecf7825cc1"}],"orderType":"2","startTime":"1681810415","endTime":"1681983215","zoneHash":"0x0000000000000000000000000000000000000000000000000000000000000000","salt":"1550213294656772168494388599483486699884316127427085531712538817979596","conduitKey":"0x0000007b02230091a7ed01230072f7006a004d60a8d4e71d599b8104250f0000","counter":"0"}}',
],
});
console.log(result);
};

/**
* Sending ETH
*/
Expand Down Expand Up @@ -1339,8 +1452,8 @@ const initialize = async () => {
siweBadAccount.onclick = async () => {
const domain = window.location.host;
const from = '0x0000000000000000000000000000000000000000';
const siweMessageBadDomain = `${domain} wants you to sign in with your Ethereum account:\n${from}\n\nI accept the MetaMask Terms of Service: https://community.metamask.io/tos\n\nURI: https://${domain}\nVersion: 1\nChain ID: 1\nNonce: 32891757\nIssued At: 2021-09-30T16:25:24.000Z\nResources:\n- ipfs://Qme7ss3ARVgxv6rXqVPiikMJ8u2NLgmgszg13pYrDKEoiu\n- https://example.com/my-web2-claim.json`;
siweSign(siweMessageBadDomain);
const siweMessageBadAccount = `${domain} wants you to sign in with your Ethereum account:\n${from}\n\nI accept the MetaMask Terms of Service: https://community.metamask.io/tos\n\nURI: https://${domain}\nVersion: 1\nChain ID: 1\nNonce: 32891757\nIssued At: 2021-09-30T16:25:24.000Z\nResources:\n- ipfs://Qme7ss3ARVgxv6rXqVPiikMJ8u2NLgmgszg13pYrDKEoiu\n- https://example.com/my-web2-claim.json`;
seaona marked this conversation as resolved.
Show resolved Hide resolved
siweSign(siweMessageBadAccount);
};

/**
Expand Down
Loading