search

MetaMask / metamask-extension

:globe_with_meridians: :electric_plug: The MetaMask browser extension enables browsing Ethereum blockchain enabled websites
https://metamask.io
Other
11.66k stars 4.78k forks source link

Prevent transaction failures for ledger users when requests to the ledger cdn fail #25666

Open danjm opened 4 days ago

danjm commented 4 days ago

As was the case here https://github.com/MetaMask/metamask-extension/issues/25623 and here https://github.com/MetaMask/metamask-extension/issues/17964, it is possible for server side problems related to the https://cdn.live.ledger.com/plugins/ethereum.json endpoint to cause ledger transactions to fail (before they are published to the blockchain).

If the network request in loadInfosForContractMethod (https://github.com/LedgerHQ/ledger-live/blob/173bb3c84cc855f83ab8dc49362bc381afecc31e/libs/ledgerjs/packages/hw-app-eth/src/services/ledger/contracts.ts#L17) call in the signTransaction method of the Eth class in the hw-app-eth library fails, then transaction signing will fail.

Ledger users should be able to sign transactions even if ledger servers are down entirely.

The network requests made here get information that can be useful for ledger users, and help them make secure decisions. As we resolve this issue, we should be mindful that in the case where ledger servers are down (or there are CORS issues as was the case in the above linked issues), the users are effectively "blind signing" on the device, without helpful cues like token names or symbols. We may want to give a warning in these cases.

lambertkevin commented 4 days ago

This problem has been fixed in a later version of hw-app-eth, Metamask is still using a 3 year old version of it, but we can't update the lib in your stack because of this issue: https://github.com/MetaMask/eth-ledger-bridge-keyring/issues/217 😞