Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add malicious deeplinks, bypasses and reorg #328

Merged
merged 4 commits into from
Apr 25, 2024

Conversation

seaona
Copy link
Contributor

@seaona seaona commented Apr 23, 2024

Description

In this PR we add a couple of more functionalities for testing the PPOM feature:

  • Added the ability to try Malicious Deeplinks for Mobile -> this has uncovered the following issue [Bug]: PPOM - Malicious Deeplink transactions are not being flagged metamask-mobile#9365
  • Added a new section for Bypasses -> here we gather the identified bypasses for Blockaid. Now all of them are fixed except the Malicious Permit with Padded ChainId, but it is fixed in the next MM release, which contains the new ppom version chore: Update ppom package metamask-extension#24171
  • Moved the Transfer/Approve with Odd Hex data to the Bypasses section -> this is done since they are better matching to this new section, as those were identified bypasses for Blockaid, opposed to the malformed transactions.
  • Added a descriptive text for each section, to help manual QAs

Screenshots

Before

Screenshot from 2024-04-25 09-50-58

After

Screenshot from 2024-04-23 21-10-05

malicious-deeplinks-bypasses.mp4

Manual QA Steps

  1. Build the test dapp locally
  2. Try the new bypasses buttons. Note: all bypasses should be flagged except for the Malicious Permit With Padded ChainID (which will be fixed in the ppom updat 1.4.6)
  3. Go to Mobile browser
  4. Go to localhost:9011
  5. Try the deeplinks
  6. Open MM and see each deeplink working. Note: all the deeplinks are not flagged by Blockaid at the moment, since there is an issue with Blockaid + Deeplinks in Mobile

@seaona seaona marked this pull request as ready for review April 25, 2024 07:45
@@ -3069,65 +3102,6 @@ const initializeFormElements = () => {
}
};

/**
* Send With Odd Hex Data
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this piece just moved to the new ppom section


const handleNewChain = (chainId) => {
chainIdDiv.innerHTML = chainId;
const networkId = parseInt(networkDiv.innerHTML, 10);
chainIdInt = parseInt(chainIdDiv.innerHTML, 16) || networkId;
chainIdPadded = `0x${chainIdInt.toString(16).padStart(77, '0')}`;
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need this new format for the ChainID padded integer bypass

@@ -1636,7 +1669,7 @@ const initializeFormElements = () => {
params: [
{
from: accounts[0],
to: '0x5FbDB2315678afecb367f032d93F642f64180aa3',
to: `${maliciousAddress}`,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all the malicious address ocurrences have been replaced by the new const variable, for clarity

@seaona seaona changed the title Add malicious deeplinks, bypasses and reorg feat: add malicious deeplinks, bypasses and reorg Apr 25, 2024
@seaona seaona merged commit fd76621 into main Apr 25, 2024
7 checks passed
@seaona seaona deleted the ppom-bypasses-deeplinks-reorg branch April 25, 2024 11:01
@seaona seaona mentioned this pull request May 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants