`signTypedData` input validation
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- typescript
- Domain
- cryptography, security
Research direction
Start at the signTypedData entry point and trace how integer, byte, and address inputs are encoded. Use the listed negative, out-of-bounds, and oversized-address examples to define rejection behavior; done means invalid inputs are rejected and valid encodings remain standard and portable. Add focused tests for each validation case.
Written by the indexing model from the issue text.
Description
We don't have much in the way of input validation for signTypedData. This is dangerous because invalid inputs can result in non-standard encodings.
Some examples of this are:
- Negative
uintvalues are currently encoded as positive values. The negative is ignored. - Some out-of-bounds integer values and byte values are possible to encode right now.
- We don't validate address input, so the
addressfield can be used to store values far larger than an address.
We should strictly validate input, so that users don't accidentally become reliant upon non-standard and non-portable encodings.
- Dominant language
- TypeScript
- Stars
- 584
- Forks
- 230
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from MetaMask/eth-sig-util
-
team-wallet-framework
Difficulty 1/5 Under an hour Newbie friendliness 50/100
MetaMask/eth-sig-util#353 ·
-
tsconfig: Disable `strictNullChecks`, enable `strict`Possibly taken @itzKLAUS claimed this 15 days ago. Openteam-wallet-framework
Difficulty 1/5 Under an hour Newbie friendliness 55/100
MetaMask/eth-sig-util#352 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 25/100
MetaMask/eth-sig-util#328 ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 35/100
MetaMask/eth-sig-util#304 · 4 comments · 4 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
MetaMask/eth-sig-util#303 ·
All issues in MetaMask/eth-sig-util
Similar issues
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 90/100
lingdojo/kana-dojo#32663 · 1 comment · 5 reactions ·
Maintainers usually reply within 1 day
-
Admin: Title Separator field can't be cleared (input falls back to "|")Possibly taken @emdashbot claimed this today. Openbot:bug bot:in-review
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
emdash-cms/emdash#4236 · 3 comments ·
Maintainers usually reply within 1 day
-
PHP workflow streaming requests buffer the full SSE responsePossibly taken @Winoren claimed this today. Openreview: medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
langgenius/dify#44270 · 1 comment · 1 reaction ·
Maintainers usually reply within 1 day
-
area:holodeck review-finding
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
hyperdrive-technology/holodeck#142 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
code-yeongyu/senpi#3573 ·
Maintainers usually reply within 1 day