LedgerHQ / wallet-connect-live-app

https://wallet-connect-live-app.vercel.app/
7 stars 5 forks source link

【wrong "personal_sign" signature】can not get correct signature signing unreadable 32 bytes hex msg (such as safeTxHash) in function "personal_sign" #191

Open TangCYxy opened 2 hours ago

TangCYxy commented 2 hours ago

Conclusion: 1 we believe inside the ledger live app there are some compatible problem in the implementation of "wallet connect protocol". when we pass the hex string to "personal_sign", the hex string stands for its hex code and should be directly add the prefix of "personal_sign" and go on signing. But in our practice of signing unreadable msg, there is no correct signature

Key words: wallet connect, personal sign, unreadable message, wrong signature produced

Backgrounds: we have an website that allows user sign in and operate with eoa address wallet through "wallet connect" 1 for situation sign in: user is required to "personalSign" an readable msg that prove controlation of this address, which is an normal way of web3 login. message to sign is like "you are signing to login xxx, random provf is xxx" ledger and metamask both runs well and response the correct signature.

2 for situation operate: user is required to "personalSign" an 32 bytes unreadable msg called "safeTxHash" stands for a coresponding transaction in gnosis safe. message to sign is like "0x1122334411223344112233441122334411223344112233441122334411223344" metamask produces correct signature but ledger live not.

Reproduce steps: 1 build a simple front-end project that enables wallet connect 2 prepare a 32 bytes length hex string to sign called "TestMsg", such as "0x1122334411223344112233441122334411223344112233441122334411223344" 3 prepare ledger live app along with nano s plus, and a metamask app(for contrasting) 3 the front-end project produces a button, when pressed, it sends the "TestMsg" to wallet app signing with function "personall_sign" through wallet connect, after signing, signature will be alert in the web dialog image 4 do personal_sign respectively in metamask and ledger live 5 verify the signature, we will see that metamask produces correct signature while ledger live not.

One more things: 1 we got several ways that can avoid problem described above, such as operating through metamask app or chrome extension (add account in metamask from hardware "ledger"), or select another way connecting ledger (instead of walllet connect)

TangCYxy commented 2 hours ago

actually the problem we are facing is simillar to this issue, https://github.com/LedgerHQ/wallet-connect-live-app/issues/121 but the answer of this issue is saying something else.

all in one, we want to "personal_sign" a 32 bytes hex message correctly, not to sign the 66 bytes length string literally.