superhero-com / superhero-wallet

Superhero Wallet – More than just a way to receive, store & send tokens on the æternity blockchain
https://wallet.superhero.com
ISC License
39 stars 38 forks source link

Investigate Confirmation on User's Demand, currently relies on SDK request #2981

Open smaroudasunicorn opened 5 months ago

onvisions commented 1 week ago

As requested by @CedrikNikita I'm providing a template for Unknown URL case of a third party dapp that might be malicious with high probability.

DESIGN: Tx Access, Sign, Raw tx-1 Tx Access, Sign, Raw tx-2

FIGMA REFERENCE: https://www.figma.com/design/3oGLWzSH0oJljo4RETZtur/Superhero-Wallet-UI-(%E2%9C%94%EF%B8%8FUpdated)?node-id=34379-240771&node-type=instance&t=9seIxZoOgv2mi7mz-0

Other than that I think it's high time to implement the updated version of all these templates for signing messages, allowing access, RAW transactions, with errors and warnings, etc. I have designed (and synced with Nikita) pretty neat templates which require only minor modifications of our existing template but will bring more consistency and professional look and feel of the UI as currently it's a bit messed up. Also it creates confusion for QA team while testing as the Figma reference is different from implementation. @smaroudasunicorn may be we can include it as task in the next sprint. I don't see huge amount of work needed but rather more attention to details such as colors, opacity, labels, wording, external linking with proper icons, updated button labels etc.

smaroudasunicorn commented 1 week ago

An external source is requesting to connect with our wallet, sign a transaction/message. We should always display the modal and the origin of the request or that the origin URL is unknown.

Tick box is not need a simple information is enough. Also instead of unknown dapp I would put Unknown Source.

onvisions commented 1 week ago

@smaroudasunicorn

  1. We always display the confirmation modal, there is no question about it.

If you think the checkbox is overkill it is easy to be removed. However...

  1. In the case of Unknown URL an unknown source is asking for access and most probably this means that the user is being scammed or there is high probability of loss of funds and other undesired consequences. Only in this case we should display the checkbox to make sure user is aware of the risks and not proceeding without reading the warning (all the other templates that can be seen in Figma do not have a checkbox). So my suggestion is to keep the checkbox for this case that will be rarely experienced.
onvisions commented 1 week ago

@smaroudasunicorn Updated design and wording:

Tx Access, Sign, Raw tx

What do you think about that (from my previous comment):

It's high time to implement the updated version of all these templates for signing messages, allowing access, RAW transactions, with errors and warnings, etc. I have designed (and synced with Nikita) pretty neat templates which require only minor modifications of our existing template but will bring more consistency and professional look and feel of the UI as currently it's a bit messed up. Also it creates confusion for QA team while testing as the Figma reference is different from implementation. May be we can include it as task in the next sprint. I don't see huge amount of work needed but rather more attention to details such as colors, opacity, labels, wording, external linking with proper icons, updated button labels etc.

Figma reference for confirmation templates: https://www.figma.com/design/3oGLWzSH0oJljo4RETZtur/Superhero-Wallet-UI-(%E2%9C%94%EF%B8%8FUpdated)?node-id=31920-206747&node-type=frame&t=AoAt0agBepVfhnXP-0

smaroudasunicorn commented 1 week ago

Kindly ensure that you are aware of the request origin. Allowing access might cause undesired results, including loss of your funds.

onvisions commented 1 week ago

Tx Access, Sign, Raw tx