Open containerman17 opened 1 month ago
Here is a list of methods that collide with the ERC20's 4-byte transfer(address,uint256)
method signature. None of them currently replicate the 52-byte length (20+32 bytes), but it's only a matter of time.
ID | Text Signature | Bytes Signature |
---|---|---|
1111734 | workMyDirefulOwner(uint256,uint256) | 0xa9059cbb |
844280 | join_tg_invmru_haha_fd06787(address,bool) | 0xa9059cbb |
313067 | func_2093253501(bytes) | 0xa9059cbb |
161159 | transfer(bytes4[9],bytes5[6],int48[11]) | 0xa9059cbb |
31780 | many_msg_babbage(bytes1) | 0xa9059cbb |
145 | transfer(address,uint256) | 0xa9059cbb |
~An 8-byte hash should be probably sufficient~
We create a JSON file containing all the actions of a VM, which we'll call an ABI. The VM will have just one ABI that includes all its actions. A wallet receives this JSON with data, for example:
{
"to": "morpheuslqztfzdOeeyp4evmowolede688pxry662n2kwewc0094p7r89ws56wmOu542",
"value": "1234567890",
"memo": "SGV5HRoZXJlIQ=="
}
And an ABI, for example:
[
{
"id": 0,
"name": "Transfer",
"types": {
"Transfer": [
{
"name": "to",
"type": "Address"
},
{
"name": "value",
"type": "uint64"
},
{
"name": "memo",
"type": "[]uint8"
}
]
}
}
]
The ABI format is heavily influenced by EIP712, using Go language types.
With this information, a wallet (like Metamask Snap or Core) constructs two things:
Here's an example of a wallet screenshot. You can play around with the current implementation at ec2-18-224-139-0.us-east-2.compute.amazonaws.com
Signing with an ABI provided by a website is not much better than blind signing, so we need a way to validate the ABI.
auth
package boundaries. However, this could cause transaction failures during upgrades.I propose option 1 because it requires almost no effort.
WIP:
[]byte
in wallet UIBlocked:
Done:
May be:
This discussion is part of an ongoing prototype to use Metamask Snaps for a quick and easy wallet implementation in HyperSDK. Our goal is to bring HyperSDK to users efficiently. As an alternative, we considered EIP-712 signing, which is widely supported in EVM wallets, but it requires too many hacks and workarounds.
It is also applicable to future Core wallet integration.
Problem Statement
We aim to create a single Metamask Snap that supports [almost] all subnets on HyperSDK. This Snap won't know every subnet action, meaning it can't parse and label binary transactions for user signing.
Background:
Example Attack:
0x03012345
0x03
could be "Transfer all my coins" and0x012345
an attacker's address.Current Solutions
Solidity Contracts:
EIP-712 Signing:
Proposed Solution: Action Hash
uint8
(1 byte) action ID (chain.Action.GetTypeID()
) with the action's "signature hash"—a hash of all its fields, similar to Solidity's method signature hash.Benefits:
Required Modifications:
chain.Action.GetTypeID
method with an automatic hash.Alternatives:
Perfect Outcome:
Until this is resolved, we will proceed with the one Metamask Snap per VM route.