-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
[Bug]: PPOM - Malicious Deeplink transactions are not being flagged #9365
Copy link
Copy link
Closed
Labels
Sev2-normalAn issue that may lead to users misunderstanding some limited risks they are takingAn issue that may lead to users misunderstanding some limited risks they are takingrelease-7.27.1Issue or pull request that will be included in release 7.27.1Issue or pull request that will be included in release 7.27.1team-confirmationsPush issues to confirmations teamPush issues to confirmations teamteam-confirmations-secure-ux-deprecatedDEPRECATED: please use "team-confirmations" insteadDEPRECATED: please use "team-confirmations" insteadtype-bugSomething isn't workingSomething isn't working
Description
Describe the bug
Whenever I trigger a malicious transaction using a deeplink, I see how the transaction is not flagges as malicious
Expected behavior
- We should flag malicious transactions when using deeplinks.
- We should somehow flag that these transactions are coming from a deeplink: either setting origin to deeplink or origin to the hosted website
{
"id": "db05c940-02f4-11ef-a9c7-f3a73a14b6ea",
"jsonrpc": "2.0",
"method": "eth_sendTransaction",
"origin": "metamask",
"params": [{
"from": "0x07be9763a718c0539017e2ab6fc42853b4aeeb6b",
"to": "0x5fbdb2315678afecb367f032d93f642f64180aa3",
"value": "0x0"
}]}
Screenshots/Recordings
deeplink-not-flagged.mp4
See origin is set to metamask:
Steps to reproduce
- Open the wallet
- Scan the QR code below
- See how tx is not being flagged, despite having a malicious recipient
Error messages or log output
No response
Version
7.20.0 prod
Build type
None
Device
Pixel 6
Operating system
Android
Additional context
No response
Severity
No response
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
Sev2-normalAn issue that may lead to users misunderstanding some limited risks they are takingAn issue that may lead to users misunderstanding some limited risks they are takingrelease-7.27.1Issue or pull request that will be included in release 7.27.1Issue or pull request that will be included in release 7.27.1team-confirmationsPush issues to confirmations teamPush issues to confirmations teamteam-confirmations-secure-ux-deprecatedDEPRECATED: please use "team-confirmations" insteadDEPRECATED: please use "team-confirmations" insteadtype-bugSomething isn't workingSomething isn't working

