diff --git a/LICENSE b/LICENSE index f288702..f8a0f60 100644 --- a/LICENSE +++ b/LICENSE @@ -672,3 +672,110 @@ may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read . + +=========================================================================== +THIRD-PARTY FILES +=========================================================================== + +The following files are not original to this project and are distributed +under their own licenses. They are NOT covered by the GPL-3.0 license above. + +--------------------------------------------------------------------------- +File: src/shared/phishingBlocklist.json +Source: https://github.com/AugurProject/eth-phishing-detect (config.json) +Copyright: Copyright (c) 2018 kumavis +License: Don't Be a Dick Public License (DBAD), Version 1.2 +--------------------------------------------------------------------------- + +DON'T BE A DICK PUBLIC LICENSE + +Version 1.2, February 2021 + +Copyright (C) 2018 kumavis + +Everyone is permitted to copy and distribute verbatim or modified +copies of this license document. + +DON'T BE A DICK PUBLIC LICENSE +TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 1. Do whatever you like with the original work, just don't be a dick. + + Being a dick includes - but is not limited to - the following instances: + + 1a. Outright copyright infringement - Don't just copy the original + work/works and change the name. + 1b. Selling the unmodified original with no work done what-so-ever, + that's REALLY being a dick. + 1c. Modifying the original work to contain hidden harmful content. + That would make you a PROPER dick. + + 2. If you become rich through modifications, related works/services, or + supporting the original work, share the love. Only a dick would make + loads off this work and not buy the original work's creator(s) a pint. + + 3. Code is provided with no warranty. Using somebody else's code and + bitching when it goes wrong makes you a DONKEY dick. Fix the problem + yourself. A non-dick would submit the fix back or submit a bug report. + + 4. If you use code, calling it your own would make you a ROYAL dick. + Alternatively, even just a comment giving attribution to where you found + the code would be OK. + +--------------------------------------------------------------------------- +File: src/shared/scamlist.js (address data from MyEtherWallet ethereum-lists) +Source: https://github.com/MyEtherWallet/ethereum-lists (addresses-darklist.json) +Copyright: Copyright (c) 2020 MyEtherWallet +License: MIT License +--------------------------------------------------------------------------- + +MIT License + +Copyright (c) 2020 MyEtherWallet + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + +--------------------------------------------------------------------------- +File: src/shared/scamlist.js (address data from EtherScamDB) +Source: https://github.com/MrLuit/EtherScamDB (scams.yaml) +Copyright: Copyright (c) 2018 Luit Hollander +License: MIT License +--------------------------------------------------------------------------- + +MIT License + +Copyright (c) 2018 Luit Hollander + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/README.md b/README.md index 112dd89..1a141ee 100644 --- a/README.md +++ b/README.md @@ -15,10 +15,12 @@ Hence, a minimally viable ERC20 browser wallet/signer that works cross-platform. Everything you need, nothing you don't. We import as few libraries as possible, don't implement any crypto, and don't send user-specific data anywhere but a (user-configurable) Ethereum RPC endpoint (which defaults to a public node). The -extension contacts exactly three external services: the configured RPC node for +extension contacts three user-configurable services: the configured RPC node for blockchain interactions, a public CoinDesk API (no API key) for realtime price information, and a Blockscout block-explorer API for transaction history and -token balances. All three endpoints are user-configurable. +token balances. It also fetches a community-maintained phishing domain blocklist +periodically and performs best-effort Etherscan address label lookups during +transaction confirmation. In the extension is a hardcoded list of the top ERC20 contract addresses. You can add any ERC20 contract by contract address if you wish, but the hardcoded @@ -580,14 +582,25 @@ What the extension does NOT do: - No analytics or telemetry services - No token list APIs (user adds tokens manually by contract address) -- No phishing/blocklist APIs - No Infura/Alchemy dependency (any JSON-RPC endpoint works) - No backend servers operated by the developer -These three services (RPC endpoint, CoinDesk price API, and Blockscout API) are -the only external services. All three endpoints are user-configurable. Users who -want maximum privacy can point the RPC and Blockscout URLs at their own -self-hosted instances (price fetching can be disabled in a future version). +In addition to the three user-configurable services above (RPC endpoint, +CoinDesk price API, and Blockscout API), AutistMask also contacts: + +- **Phishing domain blocklist**: A community-maintained phishing domain + blocklist is vendored into the extension at build time. At runtime, the + extension fetches the live list once every 24 hours to detect newly added + domains. Only the delta (domains not already in the vendored list) is kept in + memory, keeping runtime memory usage small. The delta is persisted to + localStorage if it is under 256 KiB. +- **Etherscan address labels**: When confirming a transaction, the extension + performs a best-effort lookup of the recipient address on Etherscan to check + for phishing/scam labels. This is a direct page fetch with no API key; the + user's browser makes the request. + +Users who want maximum privacy can point the RPC and Blockscout URLs at their +own self-hosted instances (price fetching can be disabled in a future version). ### Dependencies @@ -777,6 +790,21 @@ indexes it as a real token transfer. designed as a sharp tool — users who understand the risks can configure the wallet to show everything unfiltered, unix-style. +#### Phishing Domain Protection + +AutistMask protects users from known phishing sites when they connect their +wallet or approve transactions/signatures. A community-maintained domain +blocklist is vendored into the extension at build time, providing immediate +protection without any network requests. At runtime, the extension fetches the +live list once every 24 hours and keeps only the delta (newly added domains not +in the vendored list) in memory. This architecture keeps runtime memory usage +small while ensuring fresh coverage of new phishing domains. + +When a dApp on a blocklisted domain requests a wallet connection, transaction +approval, or signature, the approval popup displays a prominent red warning +banner alerting the user. The domain checker matches exact hostnames and all +parent domains (subdomain matching). + #### Transaction Decoding When a dApp asks the user to approve a transaction, AutistMask attempts to @@ -859,6 +887,21 @@ Currently supported: GPL-3.0. See [LICENSE](LICENSE). +### Third-Party Data Files + +This repository includes data files from third-party projects that are not +covered by the GPL-3.0 license above. These files, their copyright holders, and +their licenses are: + +| File | Source | Copyright | License | +| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------------------------------------------- | +| `src/shared/phishingBlocklist.json` | [eth-phishing-detect](https://github.com/AugurProject/eth-phishing-detect) community-maintained phishing domain blocklist | Copyright (c) 2018 kumavis | [DBAD (Don't Be a Dick)](https://github.com/philsturgeon/dbad) | +| `src/shared/scamlist.js` (address data from MyEtherWallet) | [ethereum-lists](https://github.com/MyEtherWallet/ethereum-lists) `addresses-darklist.json` | Copyright (c) 2020 MyEtherWallet | MIT | +| `src/shared/scamlist.js` (address data from EtherScamDB) | [EtherScamDB](https://github.com/MrLuit/EtherScamDB) `scams.yaml` | Copyright (c) 2018 Luit Hollander | MIT | + +The full license texts for these third-party files are included in the +[LICENSE](LICENSE) file. + ## Author [@sneak](https://sneak.berlin) diff --git a/src/background/index.js b/src/background/index.js index 1060fcf..3508e28 100644 --- a/src/background/index.js +++ b/src/background/index.js @@ -12,6 +12,11 @@ const { refreshBalances, getProvider } = require("../shared/balances"); const { debugFetch } = require("../shared/log"); const { decryptWithPassword } = require("../shared/vault"); const { getSignerForAddress } = require("../shared/wallet"); +const { + isPhishingDomain, + updatePhishingList, + startPeriodicRefresh, +} = require("../shared/phishingDomains"); const storageApi = typeof browser !== "undefined" @@ -571,6 +576,11 @@ async function backgroundRefresh() { setInterval(backgroundRefresh, BACKGROUND_REFRESH_INTERVAL); +// Fetch the phishing domain blocklist delta on startup and refresh every 24h. +// The vendored blocklist is bundled at build time; this fetches only new entries. +updatePhishingList(); +startPeriodicRefresh(); + // When approval window is closed without a response, treat as rejection if (windowsApi && windowsApi.onRemoved) { windowsApi.onRemoved.addListener((windowId) => { @@ -643,6 +653,8 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => { resp.type = "sign"; resp.signParams = approval.signParams; } + // Flag if the requesting domain is on the phishing blocklist. + resp.isPhishingDomain = isPhishingDomain(approval.hostname); sendResponse(resp); } else { sendResponse(null); diff --git a/src/popup/index.html b/src/popup/index.html index 25ef681..821571d 100644 --- a/src/popup/index.html +++ b/src/popup/index.html @@ -605,6 +605,43 @@ Double-check the address before sending. + + +