Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: PPOM - Malicious transactions triggered from WalletConnect are not flagged #7725

Merged
merged 2 commits into from
Nov 9, 2023

Conversation

segun
Copy link
Contributor

@segun segun commented Nov 8, 2023

Description

When a malicious transaction is triggered from wallet connect, the blockaid banner alert is not shown. This is because the transaction is shown in the confirm screen after evaluation without calling PPOM.

The fix is to call PPOM before showing the transaction in the confirm screen.

Related issues

Fixes: #7707

Manual testing steps

  1. Open MetaMask Mobile
  2. Goto testdapp and connect via wallet connect
  3. Scroll to PPOM section and click the malicious send eth
  4. You will see a confirm screen on mobile without the blockaid alert
  5. Checkout this branch, build and deploy on device
  6. Repeat steps 2,3
  7. You will see same confirm screen as 4, but now with the blockaid banner alert.

Screenshots/Recordings

Before

IMG_1548

After

IMG_1549

Pre-merge author checklist

  • I’ve followed MetaMask Coding Standards.
  • I've clearly explained what problem this PR is solving and how it is solved.
  • I've linked related issues
  • I've included manual testing steps
  • I've included screenshots/recordings if applicable
  • I’ve included tests if applicable
  • I’ve documented my code using JSDoc format if applicable
  • I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.
  • I’ve properly set the pull request status:
    • [] In case it's not yet "ready for review", I've set it to "draft".
    • In case it's "ready for review", I've changed it from "draft" to "non-draft".

Pre-merge reviewer checklist

  • I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
  • I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

@segun segun added needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) team-confirmations-secure-ux-PR PR from the confirmations team labels Nov 8, 2023
@segun segun self-assigned this Nov 8, 2023
@segun segun requested a review from a team as a code owner November 8, 2023 08:40
Copy link
Contributor

github-actions bot commented Nov 8, 2023

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

@segun segun force-pushed the blockaid-wallet-connect-fix branch from 654e77a to 985bf40 Compare November 8, 2023 08:40
Copy link
Contributor

github-actions bot commented Nov 8, 2023

E2E test started on Bitrise: https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/560d0e2c-9cdb-46ae-ae5a-1977cc3e2939
You can also kick off another Bitrise E2E smoke test by removing and re-applying the (Run Smoke E2E) label

Copy link

sonarqubecloud bot commented Nov 8, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

0.0% 0.0% Coverage
0.0% 0.0% Duplication

@codecov-commenter
Copy link

Codecov Report

Attention: 3 lines in your changes are missing coverage. Please review.

Comparison is base (86a6593) 34.99% compared to head (92efb13) 34.99%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7725      +/-   ##
==========================================
- Coverage   34.99%   34.99%   -0.01%     
==========================================
  Files        1034     1034              
  Lines       27537    27540       +3     
  Branches     2298     2299       +1     
==========================================
  Hits         9637     9637              
- Misses      17387    17390       +3     
  Partials      513      513              
Files Coverage Δ
app/core/WalletConnect/WalletConnectV2.ts 2.24% <0.00%> (-0.04%) ⬇️

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@segun segun merged commit 975ead5 into main Nov 9, 2023
@segun segun deleted the blockaid-wallet-connect-fix branch November 9, 2023 10:36
@github-actions github-actions bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Nov 9, 2023
@github-actions github-actions bot locked and limited conversation to collaborators Nov 9, 2023
@metamaskbot metamaskbot added the release-7.12.0 Issue or pull request that will be included in release 7.12.0 label Nov 9, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
release-7.12.0 Issue or pull request that will be included in release 7.12.0 team-confirmations-secure-ux-PR PR from the confirmations team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: PPOM - Malicious transactions triggered from Wallet Connect are not flagged
5 participants