-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
[Bug]: wallet_addEthereumChain adds new default RPC URL without confirmation #12850
Copy link
Copy link
Closed
Closed
Copy link
Labels
Sev1-highAn issue that may have caused fund loss or access to wallet in the past & may still be ongoingAn issue that may have caused fund loss or access to wallet in the past & may still be ongoingrelease-7.43.0Issue or pull request that will be included in release 7.43.0Issue or pull request that will be included in release 7.43.0team-assetsteam-wallet-api-platform-deprecatedDEPRECATED: please use "team-wallet-integrations" insteadDEPRECATED: please use "team-wallet-integrations" instead
Metadata
Metadata
Assignees
Labels
Sev1-highAn issue that may have caused fund loss or access to wallet in the past & may still be ongoingAn issue that may have caused fund loss or access to wallet in the past & may still be ongoingrelease-7.43.0Issue or pull request that will be included in release 7.43.0Issue or pull request that will be included in release 7.43.0team-assetsteam-wallet-api-platform-deprecatedDEPRECATED: please use "team-wallet-integrations" insteadDEPRECATED: please use "team-wallet-integrations" instead
Type
Fields
Give feedbackNo fields configured for issues without a type.
Describe the bug
Following extension, when
wallet_addEthereumChainis called for an existing chain, before the active chain switches the user is presented with a confirmation screen warning that a different RPC url is going to be added.Without this confirmation screen we might be bumping into a phishing potential (see MetaMask/metamask-extension#16712) .
Expected behavior
The user is presented with a confirmation screen warning the user that a new RPC url for the chain he's trying to add is going to be added to the RPC list and this will turn into the default active RPC.
Screenshots/Recordings
overridingrpcurl.mov
Steps to reproduce
Error messages or log output
Detection stage
In production (default)
Version
7.38.0
Build type
None
Device
iPhone 11
Operating system
iOS, Android
Additional context
Call being made under the AddEthereumChain button:
Severity
No response