MetaMask / metamask-docs

Developer documentation for MetaMask
https://docs.metamask.io
Apache License 2.0
647 stars 929 forks source link

Wrong account connected might confuse users and is potentionally dangerous #1281

Closed ackvf closed 4 months ago

ackvf commented 4 months ago

I am not sure if something changed, but for the past two years we did not observe this issue until recently.

When user changes to a different account from within MetaMask, our app will NOT receive that information and continues functioning with the previously connected account.

In the following screenshot, notice that I remain connected to CXIP #1, but I switched to CXIP #2 in MetaMask.

0) With all accounts disconnected 1) Initiate connection from within the App by clicking on button [CONNECT WALLET] and connect with Account #1 2) In MetaMask, switch to Account #2 3) Observe that nothing happens, no event is emmited and user keeps connected with Account #1, despite seeing Account #2 in their MetaMask extension 4) For further detail, I present you the connect/disconnect option within MetaMask, where you can see that Account #1 is still Active. image 5) Only after pressing the highlighted Connect, only then the App receives an event and is allowed to handle the change. metamask-switch-disconnect

On this third attachment notice the potential dangerous situation where the user THINKS they are on Account #2, but they are in fact signing transactions with Account #1 with no clear clue other than the account name, which can easily be missed, especially if the user choses poor names.

image

Unlike in this situation, where it did show a very subtle information, which is so subtle that it's almost useless too anyway. And I don't even know what the circumstances were to see this.

"Is this the correct account? It's different from the currently selected account in your wallet"

Compare the two:

image image
ackvf commented 4 months ago

Sorry, wrong place, migrated over to https://github.com/MetaMask/metamask-extension/issues/24164