extension icon indicating copy to clipboard operation
extension copied to clipboard

Don't allow a transaction to be signed if an EVM address with mixed caps doesn't pass the checksum

Open mhluongo opened this issue 3 years ago • 2 comments

Screenshot from 2021-12-29 11-13-08

Mixed-case hex addresses imply following EIP-55, which can help prevent users from sending funds to the wrong address. If the address doesn't check out, the form shouldn't validate.

If an address is all lower-case or all upper-case, a warning should be displayed below the address input... maybe with a link to EtherScan to help users check what's up.

mhluongo avatar Dec 29 '21 16:12 mhluongo

Note this goes for sending ETH, ERC-20s, and any transaction construction really... including if a dApp built the tx.

mhluongo avatar Dec 29 '21 16:12 mhluongo

It looks like in this field we are only checking the length of the address, not actually validating if it's a legit address or not. Well, unless my taking a legit address and randomly changing characters is somehow always a legit address.

SJQuality avatar May 13 '22 19:05 SJQuality

While this is objectively good for security - while working on the RSK integration we've determined that this is not necessarily good for UX - since plenty of website (etherscan included) present users with and allow them to copy addresses that do not necessarily pass the checksum.

0xDaedalus avatar Feb 10 '23 19:02 0xDaedalus