Skip to content

Warn users whenever an ENS name contains a homoglyph vulnerability #2067

@omnat

Description

@omnat

This issue was on extension repo, and it applies to mobile too. Copying here

Details here: MetaMask/metamask-extension#9129

Problem

An ENS name is a UTF-8 compatible string of text. That means there are many characters that have the same appearance, or homo-glyph.

This can cause some concerns when using an ENS name:

  • Pasting an ENS name that looks correct could actually be wrong. as tweeted recently
  • Reverse-resolved ENS names could appear familiar but actually be deliberately crafted to be deceptive.

MyCrypto has a tool called ens-validation that can do the hard part of this already, we just need to design & display the appropriate warnings.

Acceptance criteria:

  • Entering a homoglyph-impersonation name on the send screen to field should show a warning. Can verify with vita‍lik.eth, which is not the same as vitalik.eth.
  • A confirmation screen showing an ENS name should also show a warning under any homoglyph-containing name. We could also simply not resolve a homoglyph-containing name.

Possible copy for the warning:

This name has some deceptive letters in it that resemble other letters. It is probably trying to impersonate another well-known name. Did you get this name from someone you trust?

Metadata

Metadata

Labels

Sev1-highAn issue that may have caused fund loss or access to wallet in the past & may still be ongoing

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions