[Phishing-Controller] Misleading phishing warnings caused by using outdated phishing site listings on poor networks

[CronosAce]

Hi Metamask core team, we're Fulcrom team, we have built a perpetual trading exchange on Cronos chain.

Issue

We would like to report a issue to you: When opening our website (https://fulcrom.finance) on metamask mobile in case of bad network, there is a certain probability that it will trigger a phishing alert

Reason

After analysis by our developers, the reason may be due to:

1. metamask-mobile used metamask/phishing-controller V2.0.0 as logical abstraction for detecting phishing sites
2. metamask/phishing-controller V2.0.0 used eth-phishing-detect V1.2.0 as the core logic of detecting phishing sites, and introduce an asynchronous way to get the configuration of the phishing site list in this PR: https://github.com/MetaMask/core/pull/1123
3. this is all well and good, but in the case of a bad network, the metamask/phishing-controller uses the static site list configuration obtained from eth-phishing-detect V1.2.0 as the phishing site list. This is a very stale list with a similar site to ours: fulcrum.trade and it will fuzzy match our site, causing metamask moblie to display a phishing alert. code here: https://github.com/MetaMask/core/blob/684470616b55c0ab2556bdc09bdf6970f6ba0be2/packages/phishing-controller/src/PhishingController.ts#L2 https://github.com/MetaMask/core/blob/684470616b55c0ab2556bdc09bdf6970f6ba0be2/packages/phishing-controller/src/PhishingController.ts#L235-L246

How to reproduce it

1. setup a slow network on you device
2. opening fulcrom.finance with Chrome and then click Connect button, auto jump to metamask mobile
3. shows the phishing warning alert

Suggestion

• Forced dependency on a list of configurations obtained asynchronously
• or using the eth-phishing-detect version to the latest version

---

Env info:

• memtamask ios/android version 6.3.0 (latest version)
• ios 16.3 / 16.2

[Gudahtt]

Thanks for the detailed report, and the suggestions! We will be working on this soon.