MetaMask / metamask-mobile

Mobile web browser providing access to websites that use the Ethereum blockchain
https://metamask.io
Other
2.14k stars 1.1k forks source link

Security alerts - We should run a new validation when transaction is edited on mobile #8382

Open seaona opened 8 months ago

seaona commented 8 months ago

Describe the bug

Problem: same as in Extension, whenever we edit a transaction, the PPOM validation is not updated. A benign transaction could be malicious, if we change the amount of Approve/Send. However this won't be captured by the Blockaid warning, as it does not re-run the validation on Edit.

Expected behavior

Screenshots/Recordings

https://github.com/MetaMask/metamask-mobile/assets/54408225/c7327bde-5e66-4235-b2c4-a2b452b7ceab

Steps to reproduce

  1. Enable Blockaid from Settings
  2. Trigger a malicious Approve ERC20
  3. See malicious warning is displayed
  4. Change the approve value to 0
  5. See malicious warning is still displayed / validation is not re-run

Error messages or log output

No response

Version

7.15.0

Build type

None

Device

Pixel 6

Operating system

Android

Additional context

No response

Severity

No response

github-actions[bot] commented 5 months ago

This issue has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 7 days. Thank you for your contributions.

github-actions[bot] commented 3 weeks ago

This issue has been automatically marked as stale because it has not had recent activity in the last 90 days. It will be closed in 7 days. Thank you for your contributions.