extension
extension copied to clipboard
Don't allow a transaction to be signed if an EVM address with mixed caps doesn't pass the checksum
Mixed-case hex addresses imply following EIP-55, which can help prevent users from sending funds to the wrong address. If the address doesn't check out, the form shouldn't validate.
If an address is all lower-case or all upper-case, a warning should be displayed below the address input... maybe with a link to EtherScan to help users check what's up.
Note this goes for sending ETH, ERC-20s, and any transaction construction really... including if a dApp built the tx.
It looks like in this field we are only checking the length of the address, not actually validating if it's a legit address or not. Well, unless my taking a legit address and randomly changing characters is somehow always a legit address.
While this is objectively good for security - while working on the RSK integration we've determined that this is not necessarily good for UX - since plenty of website (etherscan included) present users with and allow them to copy addresses that do not necessarily pass the checksum.