search

ArweaveTeam / arweave-js

Browser and Nodejs client for general interaction with the arweave protocol and gateways
MIT License
589 stars 129 forks source link

Spending tokens without user's consent #40

Closed vporton closed 3 years ago

vporton commented 4 years ago

A malicious or erroneous site may spend user's AR tokens in unlimited quantities by uploading big data blobs.

Additionally the user may mistakenly select a big file and spend more tokens than he or she intended.

Solution: Ask before spending money like MetaMask.

aidanok commented 4 years ago

This is a wider issue which we are working on various solutions for. The current model of uploading a keyfile to a dapp is not ideal. So we are looking at solutions like an browser extension like metamask, potentially a metamask plugin, and integrations or dapps that provide similar functionality to things like formatic and portis.io.