4 Commits

Include renames

Author	SHA1	Message	Date
sneak	4bad27e219	fix: use the gas limit a site sends as gas (closes #207) ... Sites send the gas limit under its JSON-RPC name, `gas`. ethers only reads `gasLimit`, so the field was dropped and the node's estimate was shown and signed instead. The page's request now takes `gas` as the gas limit, and the existing ceiling, display and comparison with the signed transaction cover it as they already did `gasLimit`. A request that gives both with different values is refused. Model: opus-5-5	2026-10-14 08:57:35 +00:00
clawbot	de3f7a9a11	harden: ignore a nonce the page supplies with eth_sendTransaction (closes #404) ... A site could fix the nonce of the transaction the user was asked to sign: the same nonce as a pending transaction, at a higher fee, replaces it, and a nonce above the account's next one leaves the new transaction stuck behind a gap. `nonce` is no longer one of the fields taken from the request, so the transaction always gets the account's next nonce from the network, and that is the nonce the approval screen shows and the popup signs. Model: opus-5-5	2026-10-04 18:43:04 +02:00
clawbot	33fa25adca	harden: bound the total network fee by gasLimit × fee, on both send paths (closes #399) ... The two per-field ceilings in approvalVerify.js were checked independently, but the fee a validator is paid is gasLimit × fee per gas: a gas limit and a fee each under their own ceiling still multiply to thousands of ETH, which a gas-consuming contract really collects. assertWithinCeilings now also bounds that product against MAX_TOTAL_FEE (1 ETH), so both callers — populating the dApp transaction and verifying the signed artifact — refuse it with a full sentence naming the fee and the limit. The wallet's own send in confirmTx.js pinned no fee fields, so ethers filled them from the node with no bound; it now populates the transaction and runs the same check before signing, showing the same error in the confirmation screen's reserved errors box so nothing on screen moves. Model: opus-4-8	2026-09-21 21:45:34 +02:00
clawbot	918e581ef3	harden: verify the signed transaction against what the popup displayed (closes #216) ... Verification compared the signed artifact against the dApp's request object. For every field the dApp omitted -- normally nonce, gas limit and all the fee fields, since the popup filled them in -- the number the user actually read on screen was verified by nothing, and only absolute ceilings stood behind it. The transaction is now populated in the background before the approval window opens, and that populated object is both what the popup displays and what the signed artifact is verified against. Every consequential field becomes an equality comparison; the ceilings remain as a backstop. Population failing means no approval and no window, and the error goes to the requesting page -- earlier than before, where the same estimate failed after the password had been typed. The account is pinned too: `from` is compared against the address named at approval time rather than whichever address is active at signing, so switching accounts mid-flow refuses instead of signing from an account the approval did not name. The message-signing path had the same defect and gets the same fix. Nonce selection moves earlier as a consequence; the concurrent-approval case that follows from it is tracked at #271.	2026-08-12 12:15:25 +02:00