Compare commits
1 Commits
ab3b452924
...
chore/toke
| Author | SHA1 | Date | |
|---|---|---|---|
| f7a24374ae |
@@ -1,3 +1,4 @@
|
||||
.git
|
||||
node_modules
|
||||
.DS_Store
|
||||
dist
|
||||
|
||||
4
TODO.md
4
TODO.md
@@ -23,10 +23,6 @@ get review, merge to main.
|
||||
|
||||
# Completed Steps
|
||||
|
||||
- 2026-08-09: dApp approval signing moved into the popup — the password no
|
||||
longer crosses the extension messaging boundary; the background broadcasts and
|
||||
resolves approvals only, and verifies the signed artifact against the approval
|
||||
it holds (#157).
|
||||
- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
|
||||
shims, README Entrypoints section
|
||||
- 2026-03-01: About well in settings with build info and easter egg (in flight
|
||||
|
||||
46
build.js
46
build.js
@@ -11,51 +11,9 @@ function ensureDir(dir) {
|
||||
fs.mkdirSync(dir, { recursive: true });
|
||||
}
|
||||
|
||||
function getBuildInfo() {
|
||||
const pkg = JSON.parse(
|
||||
fs.readFileSync(path.join(__dirname, "package.json"), "utf8"),
|
||||
);
|
||||
let commitHash = "unknown";
|
||||
try {
|
||||
commitHash = execSync("git rev-parse --short HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
let commitHashFull = "unknown";
|
||||
try {
|
||||
commitHashFull = execSync("git rev-parse HEAD", {
|
||||
encoding: "utf8",
|
||||
}).trim();
|
||||
} catch (_) {
|
||||
// not a git repo or git not available
|
||||
}
|
||||
return {
|
||||
version: pkg.version,
|
||||
license: pkg.license,
|
||||
author: pkg.author,
|
||||
commitHash,
|
||||
commitHashFull,
|
||||
buildDate: new Date().toISOString().slice(0, 10),
|
||||
};
|
||||
}
|
||||
|
||||
async function build() {
|
||||
console.log("Building AutistMask extension...");
|
||||
|
||||
const buildInfo = getBuildInfo();
|
||||
console.log("Build info:", buildInfo);
|
||||
|
||||
const define = {
|
||||
__BUILD_VERSION__: JSON.stringify(buildInfo.version),
|
||||
__BUILD_LICENSE__: JSON.stringify(buildInfo.license),
|
||||
__BUILD_AUTHOR__: JSON.stringify(buildInfo.author),
|
||||
__BUILD_COMMIT__: JSON.stringify(buildInfo.commitHash),
|
||||
__BUILD_COMMIT_FULL__: JSON.stringify(buildInfo.commitHashFull),
|
||||
__BUILD_DATE__: JSON.stringify(buildInfo.buildDate),
|
||||
};
|
||||
|
||||
// compile tailwind CSS
|
||||
console.log("Compiling Tailwind CSS...");
|
||||
const tailwindInput = path.join(SRC, "popup", "styles", "main.css");
|
||||
@@ -80,7 +38,6 @@ async function build() {
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
define,
|
||||
});
|
||||
|
||||
// bundle background script
|
||||
@@ -92,7 +49,6 @@ async function build() {
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
define,
|
||||
});
|
||||
|
||||
// bundle content script
|
||||
@@ -104,7 +60,6 @@ async function build() {
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
define,
|
||||
});
|
||||
|
||||
// bundle inpage script (injected into page context, separate file)
|
||||
@@ -116,7 +71,6 @@ async function build() {
|
||||
platform: "browser",
|
||||
target: ["chrome110", "firefox110"],
|
||||
minify: true,
|
||||
define,
|
||||
});
|
||||
|
||||
// copy popup HTML
|
||||
|
||||
161
scripts/apply-enrichment.mjs
Normal file
161
scripts/apply-enrichment.mjs
Normal file
@@ -0,0 +1,161 @@
|
||||
#!/usr/bin/env node
|
||||
// Apply enrichment data to tokenList.js: add name + url fields to each token.
|
||||
|
||||
import { readFileSync, writeFileSync } from "fs";
|
||||
|
||||
const enrichment = JSON.parse(
|
||||
readFileSync("scripts/token-enrichment.json", "utf8"),
|
||||
);
|
||||
|
||||
// Well-known URLs for major tokens not in ethereum-lists.
|
||||
// These are official project websites verified from public sources.
|
||||
const EXTRA_URLS = {
|
||||
"0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2": "https://weth.io",
|
||||
"0xdAC17F958D2ee523a2206206994597C13D831ec7": "https://tether.to",
|
||||
"0xB8c77482e45F1F44dE1745F52C74426C631bDD52": "https://www.bnbchain.org",
|
||||
"0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48": "https://www.circle.com/usdc",
|
||||
"0xdC035D45d973E3EC169d2276DDab16f1e407384F": "https://sky.money",
|
||||
"0x2AF5D2aD76741191D15Dfe7bF6aC92d4Bd912Ca3": "https://www.bitfinex.com",
|
||||
"0x514910771AF9Ca656af840dff83E8264EcF986CA": "https://chain.link",
|
||||
"0x4c9EDD5852cd905f086C759E8383e09bff1E68B3": "https://ethena.fi",
|
||||
"0x8d0D000Ee44948FC98c9B98A4FA4921476f08B0d":
|
||||
"https://www.worldlibertyfinancial.com",
|
||||
"0x6B175474E89094C44Da98b954EedeAC495271d0F": "https://makerdao.com",
|
||||
"0x6c3ea9036406852006290770BEdFcAbA0e23A0e8":
|
||||
"https://www.paypal.com/us/digital-wallet/manage-money/crypto/pyusd",
|
||||
"0x95aD61b0a150d79219dCF64E1E6Cc01f0B64C4cE": "https://shibatoken.com",
|
||||
"0xdA5e1988097297dCdc1f90D4dFE7909e847CBeF6":
|
||||
"https://www.worldlibertyfinancial.com",
|
||||
"0xA0b73E1Ff0B80914AB6fe0444E65848C4C34450b": "https://crypto.com",
|
||||
"0x582d872A1B094FC48F5DE31D3B73F2D9bE47def1": "https://ton.org",
|
||||
"0x68749665FF8D2d112Fa859AA293F07A622782F38": "https://gold.tether.to",
|
||||
"0x196C20DA81Fbc324EcdF55501e95Ce9f0bD84d14": "https://polkadot.network",
|
||||
"0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984": "https://uniswap.org",
|
||||
"0x45804880De22913dAFE09f4980848ECE6EcbAf78":
|
||||
"https://www.paxos.com/paxgold",
|
||||
"0x3c3a81e81dc49A522A592e7622A7E711c06bf354": "https://www.mantle.xyz",
|
||||
"0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9": "https://aave.com",
|
||||
"0x75231F58b43240C9718Dd58B4967c5114342a86c": "https://www.okx.com",
|
||||
"0x6982508145454Ce325dDbE47a25d4ec3d2311933": "https://www.pepe.vip",
|
||||
"0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599": "https://wbtc.network",
|
||||
"0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84": "https://lido.fi",
|
||||
"0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32": "https://lido.fi",
|
||||
"0xC18360217D8F7Ab5e7c516566761Ea12Ce7F9D72": "https://ens.domains",
|
||||
"0x7D1AfA7B718fb893dB30A3aBc0Cfc608AaCfeBB0": "https://polygon.technology",
|
||||
"0x9f8F72aA9304c8B593d555F12eF6589cC3A579A2": "https://makerdao.com",
|
||||
"0xD533a949740bb3306d119CC777fa900bA034cd52": "https://curve.fi",
|
||||
"0x111111111117dC0aa78b770fA6A738034120C302": "https://1inch.io",
|
||||
"0x163f8C2467924be0ae7B5347228CABF260318753": "https://worldcoin.org",
|
||||
"0xba100000625a3754423978a60c9317c58a424e3D": "https://balancer.fi",
|
||||
"0xC011a73ee8576Fb46F5E1c5751cA3B9Fe0af2a6F": "https://synthetix.io",
|
||||
"0x1a7e4e63778B4f12a199C062f3eFdD288afCBce8": "https://www.euler.finance",
|
||||
"0xBBbbCA6A901c926F240b89EacB641d8Aec7AEafD": "https://loopring.org",
|
||||
"0xC669928185DbCE49d2230CC9B0979BE6DC797957": "https://bitstable.finance",
|
||||
"0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0": "https://lido.fi",
|
||||
"0xBe9895146f7AF43049ca1c1AE358B0541Ea49704":
|
||||
"https://www.coinbase.com/cbeth",
|
||||
"0xfAbA6f8e4a5E8Ab82F62fe7C39859FA577269BE3": "https://ondo.finance",
|
||||
"0x0C10bF8FcB7Bf5412187A595ab97a3609160b5c6": "https://decentraland.org",
|
||||
"0x6De037ef9aD2725EB40118Bb1702EBb27e4Aeb24": "https://www.render.com",
|
||||
"0x4a220E6096B25EADb88358cb44068A3248254675": "https://www.quant.network",
|
||||
"0xba5BDe662c17e2aDFF1075610382B9B691296350": "https://superrare.com",
|
||||
"0x15D4c048F83bd7e37d49eA4C83a07267Ec4203dA": "https://galxe.com",
|
||||
"0xc00e94Cb662C3520282E6f5717214004A7f26888": "https://compound.finance",
|
||||
"0xE41d2489571d322189246DaFA5ebDe1F4699F498": "https://0x.org",
|
||||
"0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e": "https://yearn.fi",
|
||||
"0x6fB3e0A217407EFFf7Ca062D46c26E5d60a14d69": "https://iotex.io",
|
||||
"0xD31a59c85aE9D8edEFec411D448f90841571b89c": "https://solana.com",
|
||||
"0xa1faa113cbE53436Df28FF0aEe54275c13B40975": "https://alphafinance.io",
|
||||
"0xF57e7e7C23978C3cAEC3C3548E3D615c346e79fF": "https://immutable.com",
|
||||
"0x0f5D2fB29fb7d3CFeE444a200298f468908cC942": "https://decentraland.org",
|
||||
"0x3845badAde8e6dFF049820680d1F14bD3903a5d0": "https://www.sandbox.game",
|
||||
"0x4d224452801ACEd8B2F0aebE155379bb5D594381": "https://apecoin.com",
|
||||
"0x6810e776880C02933D47DB1b9fc05908e5386b96": "https://gnosis.io",
|
||||
"0x5f98805A4E8be255a32880FDeC7F6728C6568bA0": "https://www.liquity.org",
|
||||
"0xd26114cd6EE289AccF82350c8d8487fedB8A0C07": "https://omg.network",
|
||||
"0x0D8775F648430679A709E98d2b0Cb6250d2887EF":
|
||||
"https://basicattentiontoken.org",
|
||||
"0xc944E90C64B2c07662A292be6244BDf05Cda44a7": "https://thegraph.com",
|
||||
"0x1985365e9f78359a9B6AD760e32412f4a445E862": "https://augur.net",
|
||||
"0x4E15361FD6b4BB609Fa63C81A2be19d873717870": "https://fantom.foundation",
|
||||
"0x853d955aCEf822Db058eb8505911ED77F175b99e": "https://frax.finance",
|
||||
"0x0000000000085d4780B73119b644AE5ecd22b376": "https://www.trueusd.com",
|
||||
"0x0cEC1A9154Ff802e7934Fc916Ed7Ca50bDE6844e": "https://polymesh.network",
|
||||
"0x956F47F50A910163D8BF957Cf5846D573E7f87CA": "https://fei.money",
|
||||
"0x3432B6A60D23Ca0dFCa7761B7ab56459D9C964D0": "https://frax.finance",
|
||||
"0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E": "https://curve.fi",
|
||||
"0x0100546F2cD4C9D97f798fFC9755E47865FF7Ee6": "https://alchemix.fi",
|
||||
"0x808507121B80c02388fAd14726482e061B8da827": "https://pendle.finance",
|
||||
"0xCa14007Eff0dB1f8135f4C25B34De49AB0d42766": "https://starknet.io",
|
||||
"0x8457CA5040ad67fdebbCC8EdCE889A335Bc0fbFB": "https://alt.layer",
|
||||
"0x4C19596f5aAfF459fA38B0f7eD92F11AE6543784": "https://www.truflation.com",
|
||||
"0xB50721BCf8d664c30412Cfbc6cf7a15145234ad1": "https://arbitrum.io",
|
||||
"0x912CE59144191C1204E64559FE8253a0e49E6548": "https://arbitrum.io",
|
||||
"0x6985884C4392D348587B19cb9eAAf157F13271cd": "https://layerzero.network",
|
||||
"0xFe0c30065B384F05761f15d0CC899D4F9F9Cc0eB": "https://ethfi.org",
|
||||
"0x18084fbA666a33d37592fA2633fD49a74DD93a88": "https://tbtc.network",
|
||||
"0x9D39A5DE30e57443BfF2A8307A4256c8797A3497": "https://suilend.fi",
|
||||
"0x5283D291DBCF85356A21bA090E6db59121208b44": "https://blur.io",
|
||||
"0x43Dfc4159D86F3A37A5A4B3D4580b888ad7d4DDd": "https://dydx.exchange",
|
||||
"0xCf0C122c6b73ff809C693DB761e7BaeBe62b6a2E": "https://floki.com",
|
||||
"0xe53EC727dbDEB9E2d5456c3be40cFF031AB40A55": "https://superfarm.com",
|
||||
"0x32353A6C91143bfd6C7d363B546e62a9A2489A20": "https://www.agora.finance",
|
||||
"0x1aBaEA1f7C830bD89Acc67eC4af516284b1bC33c": "https://www.euro-coin.com",
|
||||
"0x1a03eF3d1a80b5f214e468ACD97F55714E049393": "https://gemspad.io",
|
||||
"0x7122985656e38BDC0302Db86685bb972b145bD3C": "https://stone.fi",
|
||||
"0xa35923162C49cF95e6BF26623385eb431ad920D3": "https://www.turbo-eth.com",
|
||||
"0xdBdb4d16EdA451D0503b854CF79D55697F90c8DF": "https://alchemix.fi",
|
||||
"0x08c32b0726C5684024ea6e141C50aDe9690bBdcc": "https://stratis.io",
|
||||
"0x65Ef703f5594D2573eb71Aaf55BC0CB548492df4": "https://multichain.org",
|
||||
"0x1151CB3d861920e07a38e03eEAd12C32178567F6": "https://bonk.com",
|
||||
"0x090185f2135308BaD17527004364eBcC2D37e5F6": "https://spell.club",
|
||||
"0xAf5191B0De278C7286d6C7CC6ab6BB8A73bA2Cd6": "https://stargate.finance",
|
||||
};
|
||||
|
||||
// Apply extra URLs where enrichment has none
|
||||
for (const [addr, url] of Object.entries(EXTRA_URLS)) {
|
||||
const e = enrichment[addr];
|
||||
if (e && !e.url) {
|
||||
e.url = url;
|
||||
}
|
||||
}
|
||||
|
||||
// Read original tokenList.js
|
||||
const original = readFileSync("src/shared/tokenList.js", "utf8");
|
||||
|
||||
// Replace each token block: add name and url after decimals
|
||||
let result = original;
|
||||
let replacements = 0;
|
||||
|
||||
for (const [addr, data] of Object.entries(enrichment)) {
|
||||
// Escape special regex characters in the address
|
||||
const escaped = addr.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
|
||||
|
||||
// Match the token block: { address: "...", symbol: "...", decimals: N, }
|
||||
// The closing }, may have trailing whitespace
|
||||
const blockRe = new RegExp(
|
||||
`(\\{\\s*address:\\s*"${escaped}",\\s*symbol:\\s*"[^"]+",\\s*decimals:\\s*\\d+),?(\\s*\\})`,
|
||||
);
|
||||
|
||||
const match = result.match(blockRe);
|
||||
if (!match) {
|
||||
console.error(`WARNING: Could not find block for ${addr}`);
|
||||
continue;
|
||||
}
|
||||
|
||||
// Build replacement: original fields + name + url
|
||||
const nameEscaped = data.name.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
|
||||
const urlEscaped = data.url.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
|
||||
const replacement =
|
||||
match[1] +
|
||||
`,\n name: "${nameEscaped}",` +
|
||||
`\n url: "${urlEscaped}",` +
|
||||
match[2];
|
||||
|
||||
result = result.replace(blockRe, replacement);
|
||||
replacements++;
|
||||
}
|
||||
|
||||
console.error(`Applied ${replacements} enrichments to tokenList.js`);
|
||||
writeFileSync("src/shared/tokenList.js", result);
|
||||
console.error("Done!");
|
||||
87
scripts/enrich-tokens.mjs
Normal file
87
scripts/enrich-tokens.mjs
Normal file
@@ -0,0 +1,87 @@
|
||||
#!/usr/bin/env node
|
||||
// Temporary script: fetch name + homepage URL for every token in tokenList.js
|
||||
// Phase 1: CoinGecko /coins/list (1 bulk call) for names — gets 100%
|
||||
// Phase 2: ethereum-lists GitHub repo for project URLs — gets ~15%
|
||||
|
||||
import { readFileSync, writeFileSync } from "fs";
|
||||
|
||||
const src = readFileSync("src/shared/tokenList.js", "utf8");
|
||||
|
||||
const tokens = [];
|
||||
const re =
|
||||
/\{\s*address:\s*"(0x[a-fA-F0-9]{40})",\s*symbol:\s*"([^"]+)",\s*decimals:\s*(\d+)/g;
|
||||
let m;
|
||||
while ((m = re.exec(src)) !== null) {
|
||||
tokens.push({ address: m[1], symbol: m[2], decimals: parseInt(m[3]) });
|
||||
}
|
||||
console.error(`Parsed ${tokens.length} tokens`);
|
||||
|
||||
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
|
||||
|
||||
// --- Phase 1: bulk names from CoinGecko ---
|
||||
console.error("Fetching CoinGecko coins list...");
|
||||
const listResp = await fetch(
|
||||
"https://api.coingecko.com/api/v3/coins/list?include_platform=true",
|
||||
);
|
||||
if (!listResp.ok) throw new Error(`CoinGecko list HTTP ${listResp.status}`);
|
||||
const coins = await listResp.json();
|
||||
|
||||
const addrMap = new Map();
|
||||
for (const coin of coins) {
|
||||
const eth = (coin.platforms?.ethereum || "").toLowerCase().trim();
|
||||
if (eth && eth.startsWith("0x")) {
|
||||
addrMap.set(eth, { name: coin.name, id: coin.id });
|
||||
}
|
||||
}
|
||||
console.error(`CoinGecko map: ${addrMap.size} Ethereum tokens`);
|
||||
|
||||
const enriched = new Map();
|
||||
for (const t of tokens) {
|
||||
const info = addrMap.get(t.address.toLowerCase());
|
||||
enriched.set(t.address, { name: info?.name || t.symbol, url: "" });
|
||||
}
|
||||
console.error(
|
||||
`Matched ${[...enriched.values()].filter((e) => e.name).length}/${tokens.length} names`,
|
||||
);
|
||||
|
||||
// --- Phase 2: ethereum-lists GitHub for URLs ---
|
||||
console.error("Fetching URLs from ethereum-lists GitHub...");
|
||||
const CONCURRENT = 10;
|
||||
let urlsFound = 0;
|
||||
|
||||
for (let i = 0; i < tokens.length; i += CONCURRENT) {
|
||||
const batch = tokens.slice(i, i + CONCURRENT);
|
||||
await Promise.allSettled(
|
||||
batch.map(async (t) => {
|
||||
try {
|
||||
const r = await fetch(
|
||||
`https://raw.githubusercontent.com/ethereum-lists/tokens/master/tokens/eth/${t.address}.json`,
|
||||
);
|
||||
if (!r.ok) return;
|
||||
const data = await r.json();
|
||||
const website = (data.website || "").trim();
|
||||
if (website && website !== "https://") {
|
||||
enriched.get(t.address).url = website;
|
||||
urlsFound++;
|
||||
}
|
||||
} catch {
|
||||
// ignore
|
||||
}
|
||||
}),
|
||||
);
|
||||
if (i % 100 === 0) {
|
||||
console.error(
|
||||
` GitHub: ${Math.min(i + CONCURRENT, tokens.length)}/${tokens.length}, ${urlsFound} URLs`,
|
||||
);
|
||||
}
|
||||
await sleep(200);
|
||||
}
|
||||
console.error(`Phase 2 done: ${urlsFound} URLs from ethereum-lists`);
|
||||
|
||||
// --- Output ---
|
||||
const output = {};
|
||||
for (const [addr, e] of enriched) {
|
||||
output[addr] = { name: e.name, url: e.url };
|
||||
}
|
||||
writeFileSync("scripts/token-enrichment.json", JSON.stringify(output, null, 2));
|
||||
console.error(`Done! ${tokens.length} names, ${urlsFound} URLs.`);
|
||||
2050
scripts/token-enrichment.json
Normal file
2050
scripts/token-enrichment.json
Normal file
File diff suppressed because it is too large
Load Diff
@@ -5,6 +5,7 @@
|
||||
const { DEFAULT_RPC_URL } = require("../shared/constants");
|
||||
const { SUPPORTED_CHAIN_IDS, networkByChainId } = require("../shared/networks");
|
||||
const { onChainSwitch } = require("../shared/chainSwitch");
|
||||
const { getBytes } = require("ethers");
|
||||
const {
|
||||
state,
|
||||
loadState,
|
||||
@@ -13,7 +14,8 @@ const {
|
||||
} = require("../shared/state");
|
||||
const { refreshBalances, getProvider } = require("../shared/balances");
|
||||
const { debugFetch } = require("../shared/log");
|
||||
const { verifySignedTx, verifySignature } = require("../shared/approvalVerify");
|
||||
const { decryptWithPassword } = require("../shared/vault");
|
||||
const { getSignerForAddress } = require("../shared/wallet");
|
||||
const {
|
||||
isPhishingDomain,
|
||||
updatePhishingList,
|
||||
@@ -723,28 +725,39 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
return true;
|
||||
}
|
||||
|
||||
// The popup signs; it reports back here when it could not. Fail the
|
||||
// request the same way this handler used to when it did the signing.
|
||||
if (msg.error) {
|
||||
approval.resolve({ error: { message: msg.error } });
|
||||
sendResponse({ error: msg.error });
|
||||
return false;
|
||||
}
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await loadState();
|
||||
const activeAddress = await getActiveAddress();
|
||||
// The popup holds the secret, but the background stays the
|
||||
// authority on what is broadcast: the raw transaction must be
|
||||
// the approved one, signed by the approved address.
|
||||
verifySignedTx(
|
||||
msg.rawSignedTx,
|
||||
approval.txParams,
|
||||
activeAddress,
|
||||
let wallet, addrIndex;
|
||||
for (const w of state.wallets) {
|
||||
for (let i = 0; i < w.addresses.length; i++) {
|
||||
if (w.addresses[i].address === activeAddress) {
|
||||
wallet = w;
|
||||
addrIndex = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (wallet) break;
|
||||
}
|
||||
if (!wallet) throw new Error("Wallet not found");
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
let decrypted = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
msg.password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
addrIndex,
|
||||
decrypted,
|
||||
);
|
||||
// Best-effort: clear decrypted secret after use.
|
||||
// Note: JS strings are immutable; this nulls the reference but
|
||||
// the original string may persist in memory until GC.
|
||||
decrypted = null;
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const tx = await provider.broadcastTransaction(msg.rawSignedTx);
|
||||
const connected = signer.connect(provider);
|
||||
const tx = await connected.sendTransaction(approval.txParams);
|
||||
approval.resolve({ txHash: tx.hash });
|
||||
sendResponse({ txHash: tx.hash });
|
||||
} catch (e) {
|
||||
@@ -771,23 +784,55 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
|
||||
return true;
|
||||
}
|
||||
|
||||
// The popup signs; it reports back here when it could not. Fail the
|
||||
// request the same way this handler used to when it did the signing.
|
||||
if (msg.error) {
|
||||
approval.resolve({ error: { message: msg.error } });
|
||||
sendResponse({ error: msg.error });
|
||||
return false;
|
||||
}
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
await loadState();
|
||||
const activeAddress = await getActiveAddress();
|
||||
// The popup holds the secret, but the background stays the
|
||||
// authority on what is handed back to the page: the signature
|
||||
// must cover the approved payload and recover to the approved
|
||||
// address.
|
||||
const signature = msg.signature;
|
||||
verifySignature(approval.signParams, signature, activeAddress);
|
||||
let wallet, addrIndex;
|
||||
for (const w of state.wallets) {
|
||||
for (let i = 0; i < w.addresses.length; i++) {
|
||||
if (w.addresses[i].address === activeAddress) {
|
||||
wallet = w;
|
||||
addrIndex = i;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (wallet) break;
|
||||
}
|
||||
if (!wallet) throw new Error("Wallet not found");
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
let decrypted = await decryptWithPassword(
|
||||
wallet.encryptedSecret,
|
||||
msg.password,
|
||||
);
|
||||
const signer = getSignerForAddress(
|
||||
wallet,
|
||||
addrIndex,
|
||||
decrypted,
|
||||
);
|
||||
// Best-effort: clear decrypted secret after use.
|
||||
// Note: JS strings are immutable; this nulls the reference but
|
||||
// the original string may persist in memory until GC.
|
||||
decrypted = null;
|
||||
|
||||
const sp = approval.signParams;
|
||||
let signature;
|
||||
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") {
|
||||
signature = await signer.signMessage(getBytes(sp.message));
|
||||
} else {
|
||||
// eth_signTypedData_v4 / eth_signTypedData
|
||||
const typedData = JSON.parse(sp.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers handles EIP712Domain internally
|
||||
delete types.EIP712Domain;
|
||||
signature = await signer.signTypedData(
|
||||
domain,
|
||||
types,
|
||||
message,
|
||||
);
|
||||
}
|
||||
|
||||
approval.resolve({ signature });
|
||||
sendResponse({ signature });
|
||||
} catch (e) {
|
||||
|
||||
@@ -1002,64 +1002,6 @@
|
||||
</p>
|
||||
<div id="settings-denied-sites"></div>
|
||||
</div>
|
||||
|
||||
<div class="bg-well p-3 mx-1 mb-3">
|
||||
<h3 class="font-bold mb-1">About</h3>
|
||||
<p class="text-xs mb-2">
|
||||
<a
|
||||
href="https://git.eeqj.de/sneak/AutistMask"
|
||||
class="underline decoration-dashed"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
>AutistMask</a
|
||||
>
|
||||
— Minimal Ethereum wallet browser extension.
|
||||
</p>
|
||||
<div class="text-xs">
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">License:</span>
|
||||
<span id="about-license"></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Author:</span>
|
||||
<span id="about-author"></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Version:</span>
|
||||
<span
|
||||
id="about-version"
|
||||
class="cursor-pointer select-none"
|
||||
></span>
|
||||
</div>
|
||||
<div class="mb-1">
|
||||
<span class="text-muted">Release date:</span>
|
||||
<span id="about-release-date"></span>
|
||||
</div>
|
||||
<div>
|
||||
<span class="text-muted">Commit:</span>
|
||||
<a
|
||||
id="about-commit-link"
|
||||
class="underline decoration-dashed"
|
||||
target="_blank"
|
||||
rel="noopener noreferrer"
|
||||
></a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div
|
||||
id="settings-debug-well"
|
||||
class="bg-well p-3 mx-1 mb-3"
|
||||
style="display: none"
|
||||
>
|
||||
<h3 class="font-bold mb-1">Debug</h3>
|
||||
<label
|
||||
class="text-xs flex items-center gap-1 cursor-pointer"
|
||||
>
|
||||
<input type="checkbox" id="settings-debug-mode" />
|
||||
Enable debug mode
|
||||
</label>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- ============ DELETE WALLET CONFIRM ============ -->
|
||||
|
||||
@@ -1,14 +1,18 @@
|
||||
// AutistMask popup entry point.
|
||||
// Loads state, initializes views, triggers first render.
|
||||
|
||||
const { state, saveState, loadState } = require("../shared/state");
|
||||
const { setRuntimeDebug } = require("../shared/log");
|
||||
const { DEBUG } = require("../shared/constants");
|
||||
const {
|
||||
state,
|
||||
saveState,
|
||||
loadState,
|
||||
currentNetwork,
|
||||
} = require("../shared/state");
|
||||
const { refreshPrices } = require("../shared/prices");
|
||||
const { refreshBalances } = require("../shared/balances");
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
@@ -205,11 +209,21 @@ async function init() {
|
||||
await loadState();
|
||||
applyTheme(state.theme);
|
||||
|
||||
// Sync runtime debug flag from persisted state before first render
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
// Create the debug/testnet banner if needed (uses runtime debug state)
|
||||
updateDebugBanner();
|
||||
const net = currentNetwork();
|
||||
if (DEBUG || net.isTestnet) {
|
||||
const banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
if (DEBUG && net.isTestnet) {
|
||||
banner.textContent = "DEBUG / INSECURE [TESTNET]";
|
||||
} else if (net.isTestnet) {
|
||||
banner.textContent = "[TESTNET]";
|
||||
} else {
|
||||
banner.textContent = "DEBUG / INSECURE";
|
||||
}
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
|
||||
// Auto-default active address
|
||||
if (
|
||||
|
||||
@@ -10,7 +10,7 @@
|
||||
--color-border: #000000;
|
||||
--color-border-light: #cccccc;
|
||||
--color-hover: #eeeeee;
|
||||
--color-well: #e8e8e8;
|
||||
--color-well: #f5f5f5;
|
||||
--color-danger-well: #fef2f2;
|
||||
--color-section: #dddddd;
|
||||
}
|
||||
|
||||
@@ -9,19 +9,10 @@ const {
|
||||
attachCopyHandlers,
|
||||
} = require("./helpers");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const {
|
||||
formatEther,
|
||||
formatUnits,
|
||||
getBytes,
|
||||
Interface,
|
||||
toUtf8String,
|
||||
} = require("ethers");
|
||||
const { formatEther, formatUnits, Interface, toUtf8String } = require("ethers");
|
||||
const { getPrice, formatUsd } = require("../../shared/prices");
|
||||
const { ERC20_ABI } = require("../../shared/constants");
|
||||
const { TOKEN_BY_ADDRESS } = require("../../shared/tokenList");
|
||||
const { decryptWithPassword } = require("../../shared/vault");
|
||||
const { getSignerForAddress } = require("../../shared/wallet");
|
||||
const { getProvider } = require("../../shared/balances");
|
||||
const txStatus = require("./txStatus");
|
||||
const uniswap = require("../../shared/uniswap");
|
||||
const runtime =
|
||||
@@ -162,8 +153,6 @@ function showTxApproval(details) {
|
||||
details.isPhishingDomain,
|
||||
);
|
||||
|
||||
pendingTxParams = details.txParams;
|
||||
|
||||
const toAddr = details.txParams.to;
|
||||
const token = toAddr ? TOKEN_BY_ADDRESS.get(toAddr.toLowerCase()) : null;
|
||||
const ethValue = formatEther(details.txParams.value || "0");
|
||||
@@ -337,7 +326,6 @@ function showSignApproval(details) {
|
||||
);
|
||||
|
||||
const sp = details.signParams;
|
||||
pendingSignParams = sp;
|
||||
|
||||
$("approve-sign-hostname").textContent = details.hostname;
|
||||
$("approve-sign-from").innerHTML = approvalAddressHtml(sp.from);
|
||||
@@ -413,36 +401,6 @@ function show(id) {
|
||||
|
||||
let approvalId = null;
|
||||
let pendingTxDetails = null;
|
||||
// The exact parameters shown to the user, kept so the popup signs what it
|
||||
// displayed rather than re-fetching anything at approval time. Both are
|
||||
// repopulated by show() when the popup is closed and reopened.
|
||||
let pendingTxParams = null;
|
||||
let pendingSignParams = null;
|
||||
|
||||
// Approve buttons stay disabled and muted while the popup derives the key and
|
||||
// signs, which is slow enough (Argon2id) that a double click is likely.
|
||||
function setTxButtonBusy(busy) {
|
||||
$("btn-approve-tx").disabled = busy;
|
||||
$("btn-approve-tx").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
function setSignButtonBusy(busy) {
|
||||
$("btn-approve-sign").disabled = busy;
|
||||
$("btn-approve-sign").classList.toggle("text-muted", busy);
|
||||
}
|
||||
|
||||
// Locate the wallet and the address index owning the currently active
|
||||
// address. Returns null when no wallet holds it.
|
||||
function findActiveWallet() {
|
||||
for (const wallet of state.wallets) {
|
||||
for (let i = 0; i < wallet.addresses.length; i++) {
|
||||
if (wallet.addresses[i].address === state.activeAddress) {
|
||||
return { wallet, addrIndex: i };
|
||||
}
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function init(ctx) {
|
||||
$("approve-remember").addEventListener("change", async () => {
|
||||
@@ -472,78 +430,25 @@ function init(ctx) {
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-tx").addEventListener("click", async () => {
|
||||
let password = $("approve-tx-password").value;
|
||||
$("btn-approve-tx").addEventListener("click", () => {
|
||||
const password = $("approve-tx-password").value;
|
||||
if (!password) {
|
||||
showError("approve-tx-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
hideError("approve-tx-error");
|
||||
setTxButtonBusy(true);
|
||||
$("btn-approve-tx").disabled = true;
|
||||
$("btn-approve-tx").classList.add("text-muted");
|
||||
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signed transaction does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-tx-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setTxButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
const provider = getProvider(state.rpcUrl);
|
||||
const connected = signer.connect(provider);
|
||||
// This is the sequence ethers' own sendTransaction() runs
|
||||
// internally, so nonce, gas, fee and chain id population are
|
||||
// identical to when the background did the signing.
|
||||
const populated =
|
||||
await connected.populateTransaction(pendingTxParams);
|
||||
delete populated.from;
|
||||
payload.rawSignedTx = await connected.signTransaction(populated);
|
||||
} catch (e) {
|
||||
payload.error =
|
||||
e.shortMessage || e.message || "Transaction signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.txHash) {
|
||||
txStatus.showWait(pendingTxDetails, response.txHash);
|
||||
} else {
|
||||
@@ -551,7 +456,8 @@ function init(ctx) {
|
||||
(response && response.error) || "Transaction failed.";
|
||||
txStatus.showError(pendingTxDetails, null, msg);
|
||||
}
|
||||
});
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
$("btn-reject-tx").addEventListener("click", () => {
|
||||
@@ -563,93 +469,36 @@ function init(ctx) {
|
||||
window.close();
|
||||
});
|
||||
|
||||
$("btn-approve-sign").addEventListener("click", async () => {
|
||||
let password = $("approve-sign-password").value;
|
||||
$("btn-approve-sign").addEventListener("click", () => {
|
||||
const password = $("approve-sign-password").value;
|
||||
if (!password) {
|
||||
showError("approve-sign-error", "Please enter your password.");
|
||||
return;
|
||||
}
|
||||
hideError("approve-sign-error");
|
||||
setSignButtonBusy(true);
|
||||
$("btn-approve-sign").disabled = true;
|
||||
$("btn-approve-sign").classList.add("text-muted");
|
||||
|
||||
const active = findActiveWallet();
|
||||
if (!active) {
|
||||
password = null;
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"No wallet was found for the active address.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
}
|
||||
|
||||
// Decrypt here, in the popup. The password must never cross the
|
||||
// extension messaging boundary; only the signature does.
|
||||
let decryptedSecret;
|
||||
try {
|
||||
decryptedSecret = await decryptWithPassword(
|
||||
active.wallet.encryptedSecret,
|
||||
password,
|
||||
);
|
||||
} catch {
|
||||
showError(
|
||||
"approve-sign-error",
|
||||
"That password is incorrect. Please try again.",
|
||||
);
|
||||
setSignButtonBusy(false);
|
||||
return;
|
||||
} finally {
|
||||
// Best-effort: drop the password as soon as the key derivation
|
||||
// is done. Note that JS strings are immutable; this clears the
|
||||
// reference but the original string may persist until GC.
|
||||
password = null;
|
||||
}
|
||||
|
||||
const payload = {
|
||||
runtime.sendMessage(
|
||||
{
|
||||
type: "AUTISTMASK_SIGN_RESPONSE",
|
||||
id: approvalId,
|
||||
approved: true,
|
||||
};
|
||||
try {
|
||||
const signer = getSignerForAddress(
|
||||
active.wallet,
|
||||
active.addrIndex,
|
||||
decryptedSecret,
|
||||
);
|
||||
const sp = pendingSignParams;
|
||||
if (sp.method === "personal_sign" || sp.method === "eth_sign") {
|
||||
payload.signature = await signer.signMessage(
|
||||
getBytes(sp.message),
|
||||
);
|
||||
} else {
|
||||
// eth_signTypedData_v4 / eth_signTypedData
|
||||
const typedData = JSON.parse(sp.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers handles EIP712Domain internally
|
||||
delete types.EIP712Domain;
|
||||
payload.signature = await signer.signTypedData(
|
||||
domain,
|
||||
types,
|
||||
message,
|
||||
);
|
||||
}
|
||||
} catch (e) {
|
||||
payload.error = e.shortMessage || e.message || "Signing failed.";
|
||||
} finally {
|
||||
// Best-effort: clear the decrypted secret after use, with the
|
||||
// same immutability caveat as the password above.
|
||||
decryptedSecret = null;
|
||||
}
|
||||
|
||||
runtime.sendMessage(payload, (response) => {
|
||||
// TODO(security): Move decryption to popup to avoid sending password via runtime.sendMessage
|
||||
password: password,
|
||||
},
|
||||
(response) => {
|
||||
if (response && response.signature) {
|
||||
window.close();
|
||||
} else {
|
||||
const msg = (response && response.error) || "Signing failed.";
|
||||
const msg =
|
||||
(response && response.error) || "Signing failed.";
|
||||
showError("approve-sign-error", msg);
|
||||
setSignButtonBusy(false);
|
||||
$("btn-approve-sign").disabled = false;
|
||||
$("btn-approve-sign").classList.remove("text-muted");
|
||||
}
|
||||
});
|
||||
},
|
||||
);
|
||||
});
|
||||
|
||||
$("btn-reject-sign").addEventListener("click", () => {
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
// Shared DOM helpers used by all views.
|
||||
|
||||
const { isDebug } = require("../../shared/log");
|
||||
const { DEBUG } = require("../../shared/constants");
|
||||
const {
|
||||
formatUsd,
|
||||
getPrice,
|
||||
@@ -59,37 +59,19 @@ function showView(name) {
|
||||
clearFlash();
|
||||
state.currentView = name;
|
||||
saveState();
|
||||
updateDebugBanner(name);
|
||||
}
|
||||
|
||||
// Create or update the debug/insecure warning banner.
|
||||
// Called on every view switch and after the settings debug toggle changes.
|
||||
// The banner is shown when the compile-time DEBUG constant is true OR when
|
||||
// the user has enabled runtime debug mode via the settings easter egg, OR
|
||||
// when the active network is a testnet.
|
||||
function updateDebugBanner(viewName) {
|
||||
const debug = isDebug();
|
||||
const net = currentNetwork();
|
||||
const show = debug || net.isTestnet;
|
||||
let banner = document.getElementById("debug-banner");
|
||||
if (show) {
|
||||
if (!banner) {
|
||||
banner = document.createElement("div");
|
||||
banner.id = "debug-banner";
|
||||
banner.style.cssText =
|
||||
"background:#c00;color:#fff;text-align:center;font-size:10px;padding:1px 0;font-family:monospace;position:sticky;top:0;z-index:9999;";
|
||||
document.body.prepend(banner);
|
||||
}
|
||||
const suffix = viewName ? " (" + viewName + ")" : "";
|
||||
if (debug && net.isTestnet) {
|
||||
banner.textContent = "DEBUG / INSECURE [TESTNET]" + suffix;
|
||||
if (DEBUG || net.isTestnet) {
|
||||
const banner = document.getElementById("debug-banner");
|
||||
if (banner) {
|
||||
if (DEBUG && net.isTestnet) {
|
||||
banner.textContent =
|
||||
"DEBUG / INSECURE [TESTNET] (" + name + ")";
|
||||
} else if (net.isTestnet) {
|
||||
banner.textContent = "[TESTNET]" + suffix;
|
||||
banner.textContent = "[TESTNET]";
|
||||
} else {
|
||||
banner.textContent = "DEBUG / INSECURE" + suffix;
|
||||
banner.textContent = "DEBUG / INSECURE (" + name + ")";
|
||||
}
|
||||
}
|
||||
} else if (banner) {
|
||||
banner.remove();
|
||||
}
|
||||
}
|
||||
|
||||
@@ -435,7 +417,6 @@ module.exports = {
|
||||
showError,
|
||||
hideError,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
setRenderMain,
|
||||
pushCurrentView,
|
||||
goBack,
|
||||
|
||||
@@ -1,10 +1,8 @@
|
||||
const {
|
||||
$,
|
||||
showView,
|
||||
updateDebugBanner,
|
||||
showFlash,
|
||||
escapeHtml,
|
||||
flashCopyFeedback,
|
||||
goBack,
|
||||
pushCurrentView,
|
||||
} = require("./helpers");
|
||||
@@ -12,23 +10,12 @@ const { applyTheme } = require("../theme");
|
||||
const { state, saveState, currentNetwork } = require("../../shared/state");
|
||||
const { NETWORKS, SUPPORTED_CHAIN_IDS } = require("../../shared/networks");
|
||||
const { onChainSwitch } = require("../../shared/chainSwitch");
|
||||
const { log, debugFetch, setRuntimeDebug } = require("../../shared/log");
|
||||
const { log, debugFetch } = require("../../shared/log");
|
||||
const deleteWallet = require("./deleteWallet");
|
||||
const {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
} = require("../../shared/buildInfo");
|
||||
|
||||
const runtime =
|
||||
typeof browser !== "undefined" ? browser.runtime : chrome.runtime;
|
||||
|
||||
let versionClickCount = 0;
|
||||
let versionClickTimer = null;
|
||||
|
||||
function renderSiteList(containerId, siteMap, stateKey) {
|
||||
const container = $(containerId);
|
||||
const hostnames = [...new Set(Object.values(siteMap).flat())];
|
||||
@@ -155,28 +142,6 @@ function show() {
|
||||
renderSiteLists();
|
||||
renderWalletListSettings();
|
||||
|
||||
// Populate About well
|
||||
$("about-license").textContent = BUILD_LICENSE;
|
||||
// Show only the name part of the author field (strip email)
|
||||
const authorName = BUILD_AUTHOR.replace(/\s*<[^>]+>/, "");
|
||||
$("about-author").textContent = authorName;
|
||||
$("about-version").textContent = BUILD_VERSION;
|
||||
$("about-release-date").textContent = BUILD_DATE;
|
||||
$("about-commit-link").textContent = BUILD_COMMIT;
|
||||
$("about-commit-link").href = GITEA_COMMIT_URL;
|
||||
|
||||
// Reset version click counter each time settings opens
|
||||
versionClickCount = 0;
|
||||
|
||||
// Show debug well if debug mode is already enabled
|
||||
const debugWell = $("settings-debug-well");
|
||||
if (state.debugMode) {
|
||||
debugWell.style.display = "";
|
||||
} else {
|
||||
debugWell.style.display = "none";
|
||||
}
|
||||
$("settings-debug-mode").checked = state.debugMode;
|
||||
|
||||
showView("settings");
|
||||
}
|
||||
|
||||
@@ -324,66 +289,6 @@ function init(ctx) {
|
||||
ctx.showSettingsAddTokenView,
|
||||
);
|
||||
|
||||
// Bright saturated colors for easter egg flashes (clicks 6–10)
|
||||
const easterEggColors = [
|
||||
"#ff0055", // hot pink
|
||||
"#00cc44", // vivid green
|
||||
"#3366ff", // electric blue
|
||||
"#ff9900", // bright orange
|
||||
"#aa00ff", // vivid purple
|
||||
];
|
||||
|
||||
// Easter egg: click version 10 times to reveal the debug well.
|
||||
// Each click does a copy-flash animation. After 5 clicks, each
|
||||
// additional click flashes a different bright saturated color.
|
||||
$("about-version").addEventListener("click", () => {
|
||||
versionClickCount++;
|
||||
clearTimeout(versionClickTimer);
|
||||
// Reset counter if user stops clicking for 3 seconds
|
||||
versionClickTimer = setTimeout(() => {
|
||||
versionClickCount = 0;
|
||||
}, 3000);
|
||||
|
||||
const el = $("about-version");
|
||||
|
||||
if (versionClickCount > 5) {
|
||||
// Colored flash for clicks 6–10
|
||||
const colorIdx = versionClickCount - 6;
|
||||
const color = easterEggColors[colorIdx % easterEggColors.length];
|
||||
el.classList.remove("copy-flash-fade");
|
||||
el.style.backgroundColor = color;
|
||||
el.style.color = "#ffffff";
|
||||
setTimeout(() => {
|
||||
el.style.backgroundColor = "";
|
||||
el.style.color = "";
|
||||
el.classList.add("copy-flash-fade");
|
||||
setTimeout(() => {
|
||||
el.classList.remove("copy-flash-fade");
|
||||
}, 275);
|
||||
}, 75);
|
||||
} else {
|
||||
// Standard copy-flash for clicks 1–5
|
||||
flashCopyFeedback(el);
|
||||
}
|
||||
|
||||
if (versionClickCount >= 10) {
|
||||
versionClickCount = 0;
|
||||
clearTimeout(versionClickTimer);
|
||||
$("settings-debug-well").style.display = "";
|
||||
}
|
||||
});
|
||||
|
||||
// Debug mode toggle — update runtime flag, persist, and re-render banner
|
||||
$("settings-debug-mode").addEventListener("change", async () => {
|
||||
state.debugMode = $("settings-debug-mode").checked;
|
||||
setRuntimeDebug(state.debugMode);
|
||||
await saveState();
|
||||
updateDebugBanner(state.currentView);
|
||||
});
|
||||
|
||||
// Sync runtime debug flag on init
|
||||
setRuntimeDebug(state.debugMode);
|
||||
|
||||
$("btn-settings-back").addEventListener("click", () => {
|
||||
goBack();
|
||||
});
|
||||
|
||||
@@ -1,124 +0,0 @@
|
||||
// Verification of the signed artifacts produced by the approval popup.
|
||||
//
|
||||
// Signing happens in the popup, where the password is entered; the background
|
||||
// only broadcasts the raw transaction and resolves the pending approval back
|
||||
// to the requesting page. So that moving the signing out of the background
|
||||
// does not turn the background into a blind relay, the background re-derives
|
||||
// the signer from the artifact and checks it against the approval it is
|
||||
// holding before acting on it. All recovery is delegated to ethers.
|
||||
//
|
||||
// Every failure message is a full sentence, because these strings are shown to
|
||||
// the user and returned to the dApp.
|
||||
|
||||
const {
|
||||
Transaction,
|
||||
getAddress,
|
||||
getBytes,
|
||||
verifyMessage,
|
||||
verifyTypedData,
|
||||
} = require("ethers");
|
||||
|
||||
// Case-insensitive address comparison that tolerates absent values on either
|
||||
// side. Two absent addresses compare equal (contract creation has no `to`).
|
||||
function sameAddress(a, b) {
|
||||
const aMissing = a === null || a === undefined || a === "";
|
||||
const bMissing = b === null || b === undefined || b === "";
|
||||
if (aMissing || bMissing) return aMissing && bMissing;
|
||||
try {
|
||||
return getAddress(a) === getAddress(b);
|
||||
} catch {
|
||||
return String(a).toLowerCase() === String(b).toLowerCase();
|
||||
}
|
||||
}
|
||||
|
||||
// Normalize a transaction value (hex string, decimal string, number or
|
||||
// bigint) to a bigint. An absent value is zero, matching ethers.
|
||||
function normalizeValue(v) {
|
||||
if (v === null || v === undefined || v === "") return 0n;
|
||||
return BigInt(v);
|
||||
}
|
||||
|
||||
// Normalize call data to a lowercase hex string. Absent data is "0x".
|
||||
function normalizeData(v) {
|
||||
if (v === null || v === undefined || v === "" || v === "0x") return "0x";
|
||||
return String(v).toLowerCase();
|
||||
}
|
||||
|
||||
// Assert that a raw signed transaction is the transaction the user approved,
|
||||
// signed by the address the approval was raised for. Returns the parsed
|
||||
// ethers Transaction on success, throws otherwise.
|
||||
function verifySignedTx(rawSignedTx, txParams, expectedFrom) {
|
||||
if (typeof rawSignedTx !== "string" || !rawSignedTx.startsWith("0x")) {
|
||||
throw new Error("The signed transaction is missing or malformed.");
|
||||
}
|
||||
|
||||
let parsed;
|
||||
try {
|
||||
parsed = Transaction.from(rawSignedTx);
|
||||
} catch {
|
||||
throw new Error("The signed transaction could not be decoded.");
|
||||
}
|
||||
|
||||
if (!parsed.from) {
|
||||
throw new Error("The signed transaction carries no valid signature.");
|
||||
}
|
||||
if (!sameAddress(parsed.from, expectedFrom)) {
|
||||
throw new Error(
|
||||
"The signed transaction was signed by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
if (!sameAddress(parsed.to, txParams.to)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not go to the approved recipient.",
|
||||
);
|
||||
}
|
||||
if (normalizeValue(parsed.value) !== normalizeValue(txParams.value)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not carry the approved value.",
|
||||
);
|
||||
}
|
||||
if (normalizeData(parsed.data) !== normalizeData(txParams.data)) {
|
||||
throw new Error(
|
||||
"The signed transaction does not carry the approved call data.",
|
||||
);
|
||||
}
|
||||
|
||||
return parsed;
|
||||
}
|
||||
|
||||
// Assert that a signature over the approved message or typed data was
|
||||
// produced by the address the approval was raised for. Returns the recovered
|
||||
// address on success, throws otherwise.
|
||||
function verifySignature(signParams, signature, expectedFrom) {
|
||||
if (typeof signature !== "string" || !signature.startsWith("0x")) {
|
||||
throw new Error("The signature is missing or malformed.");
|
||||
}
|
||||
|
||||
let recovered;
|
||||
try {
|
||||
if (
|
||||
signParams.method === "personal_sign" ||
|
||||
signParams.method === "eth_sign"
|
||||
) {
|
||||
recovered = verifyMessage(getBytes(signParams.message), signature);
|
||||
} else {
|
||||
const typedData = JSON.parse(signParams.typedData);
|
||||
const { domain, types, message } = typedData;
|
||||
// ethers derives EIP712Domain itself and rejects it as an input.
|
||||
delete types.EIP712Domain;
|
||||
recovered = verifyTypedData(domain, types, message, signature);
|
||||
}
|
||||
} catch {
|
||||
throw new Error("The signature could not be verified.");
|
||||
}
|
||||
|
||||
if (!sameAddress(recovered, expectedFrom)) {
|
||||
throw new Error(
|
||||
"The signature was produced by a different address than the one that was approved.",
|
||||
);
|
||||
}
|
||||
|
||||
return recovered;
|
||||
}
|
||||
|
||||
module.exports = { verifySignedTx, verifySignature, sameAddress };
|
||||
@@ -1,35 +0,0 @@
|
||||
// Build-time constants injected by esbuild define in build.js.
|
||||
// These globals are replaced at bundle time with string literals.
|
||||
|
||||
/* global __BUILD_VERSION__, __BUILD_LICENSE__, __BUILD_AUTHOR__,
|
||||
__BUILD_COMMIT__, __BUILD_COMMIT_FULL__, __BUILD_DATE__ */
|
||||
|
||||
const BUILD_VERSION =
|
||||
typeof __BUILD_VERSION__ !== "undefined" ? __BUILD_VERSION__ : "dev";
|
||||
const BUILD_LICENSE =
|
||||
typeof __BUILD_LICENSE__ !== "undefined" ? __BUILD_LICENSE__ : "GPL-3.0";
|
||||
const BUILD_AUTHOR =
|
||||
typeof __BUILD_AUTHOR__ !== "undefined"
|
||||
? __BUILD_AUTHOR__
|
||||
: "sneak <sneak@sneak.berlin>";
|
||||
const BUILD_COMMIT =
|
||||
typeof __BUILD_COMMIT__ !== "undefined" ? __BUILD_COMMIT__ : "unknown";
|
||||
const BUILD_COMMIT_FULL =
|
||||
typeof __BUILD_COMMIT_FULL__ !== "undefined"
|
||||
? __BUILD_COMMIT_FULL__
|
||||
: "unknown";
|
||||
const BUILD_DATE =
|
||||
typeof __BUILD_DATE__ !== "undefined" ? __BUILD_DATE__ : "unknown";
|
||||
|
||||
const GITEA_COMMIT_URL =
|
||||
"https://git.eeqj.de/sneak/AutistMask/commit/" + BUILD_COMMIT_FULL;
|
||||
|
||||
module.exports = {
|
||||
BUILD_VERSION,
|
||||
BUILD_LICENSE,
|
||||
BUILD_AUTHOR,
|
||||
BUILD_COMMIT,
|
||||
BUILD_COMMIT_FULL,
|
||||
BUILD_DATE,
|
||||
GITEA_COMMIT_URL,
|
||||
};
|
||||
@@ -1,27 +1,12 @@
|
||||
// Leveled logger. Outputs to console with [AutistMask] prefix.
|
||||
// Level is DEBUG when the compile-time DEBUG constant is true or the runtime
|
||||
// debugMode state flag is enabled. The runtime flag is checked lazily so it
|
||||
// responds immediately when toggled in settings.
|
||||
// Level is DEBUG when the DEBUG constant is true, INFO otherwise.
|
||||
|
||||
const { DEBUG } = require("./constants");
|
||||
|
||||
const LEVELS = { debug: 0, info: 1, warn: 2, error: 3 };
|
||||
|
||||
// Runtime debug mode flag — set by settings.js when the user toggles debug
|
||||
// mode via the easter egg. Kept here as a simple mutable reference so it can
|
||||
// be updated without circular dependency issues with state.js.
|
||||
let _runtimeDebug = false;
|
||||
|
||||
function setRuntimeDebug(enabled) {
|
||||
_runtimeDebug = enabled;
|
||||
}
|
||||
|
||||
function isDebug() {
|
||||
return DEBUG || _runtimeDebug;
|
||||
}
|
||||
const threshold = DEBUG ? LEVELS.debug : LEVELS.info;
|
||||
|
||||
function emit(level, method, args) {
|
||||
const threshold = isDebug() ? LEVELS.debug : LEVELS.info;
|
||||
if (LEVELS[level] >= threshold) {
|
||||
console[method]("[AutistMask]", ...args);
|
||||
}
|
||||
@@ -52,4 +37,4 @@ async function debugFetch(url, opts) {
|
||||
return resp;
|
||||
}
|
||||
|
||||
module.exports = { log, debugFetch, setRuntimeDebug, isDebug };
|
||||
module.exports = { log, debugFetch };
|
||||
|
||||
@@ -29,7 +29,6 @@ const DEFAULT_STATE = {
|
||||
fraudContracts: [],
|
||||
tokenHolderCache: {},
|
||||
theme: "system",
|
||||
debugMode: false,
|
||||
};
|
||||
|
||||
const state = {
|
||||
@@ -69,7 +68,6 @@ async function saveState() {
|
||||
fraudContracts: state.fraudContracts,
|
||||
tokenHolderCache: state.tokenHolderCache,
|
||||
theme: state.theme,
|
||||
debugMode: state.debugMode,
|
||||
currentView: state.currentView,
|
||||
selectedWallet: state.selectedWallet,
|
||||
selectedAddress: state.selectedAddress,
|
||||
@@ -130,8 +128,6 @@ async function loadState() {
|
||||
state.fraudContracts = saved.fraudContracts || [];
|
||||
state.tokenHolderCache = saved.tokenHolderCache || {};
|
||||
state.theme = saved.theme || "system";
|
||||
state.debugMode =
|
||||
saved.debugMode !== undefined ? saved.debugMode : false;
|
||||
state.currentView = saved.currentView || null;
|
||||
state.selectedWallet =
|
||||
saved.selectedWallet !== undefined ? saved.selectedWallet : null;
|
||||
|
||||
@@ -1,355 +0,0 @@
|
||||
const { Network, Transaction, Wallet } = require("ethers");
|
||||
const {
|
||||
verifySignedTx,
|
||||
verifySignature,
|
||||
sameAddress,
|
||||
} = require("../src/shared/approvalVerify");
|
||||
const { getSignerForAddress } = require("../src/shared/wallet");
|
||||
|
||||
// Fixed test keys — never used for anything but these tests.
|
||||
const SIGNER_KEY =
|
||||
"0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
|
||||
const OTHER_KEY =
|
||||
"0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a";
|
||||
|
||||
const signer = new Wallet(SIGNER_KEY);
|
||||
const other = new Wallet(OTHER_KEY);
|
||||
|
||||
const RECIPIENT = "0x66133E8ea0f5D1d612D2502a968757D1048c214a";
|
||||
const OTHER_RECIPIENT = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
|
||||
|
||||
// Approved parameters as a dApp would supply them over eth_sendTransaction.
|
||||
const TX_PARAMS = {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
value: "0x2386f26fc10000",
|
||||
data: "0xdeadbeef",
|
||||
gas: "0x5208",
|
||||
};
|
||||
|
||||
// Build a signable transaction from approved params. The popup does the same
|
||||
// thing through populateTransaction(); here the fields are fixed so the test
|
||||
// needs no provider.
|
||||
function txFor(params) {
|
||||
return {
|
||||
chainId: 1,
|
||||
nonce: 7,
|
||||
gasLimit: 100000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
type: 2,
|
||||
to: params.to,
|
||||
value: params.value === undefined ? 0n : BigInt(params.value),
|
||||
data: params.data || "0x",
|
||||
};
|
||||
}
|
||||
|
||||
async function signedFor(params, withWallet) {
|
||||
return (withWallet || signer).signTransaction(txFor(params));
|
||||
}
|
||||
|
||||
describe("sameAddress", () => {
|
||||
test("compares checksummed and lowercase forms as equal", () => {
|
||||
expect(sameAddress(RECIPIENT, RECIPIENT.toLowerCase())).toBe(true);
|
||||
});
|
||||
|
||||
test("treats two absent addresses as equal (contract creation)", () => {
|
||||
expect(sameAddress(null, undefined)).toBe(true);
|
||||
expect(sameAddress("", null)).toBe(true);
|
||||
});
|
||||
|
||||
test("treats one absent address as unequal", () => {
|
||||
expect(sameAddress(RECIPIENT, null)).toBe(false);
|
||||
expect(sameAddress(null, RECIPIENT)).toBe(false);
|
||||
});
|
||||
|
||||
test("does not throw on values that are not addresses", () => {
|
||||
expect(sameAddress("not-an-address", RECIPIENT)).toBe(false);
|
||||
});
|
||||
});
|
||||
|
||||
describe("verifySignedTx", () => {
|
||||
test("accepts the approved transaction signed by the approved address", async () => {
|
||||
const raw = await signedFor(TX_PARAMS);
|
||||
const parsed = verifySignedTx(raw, TX_PARAMS, signer.address);
|
||||
expect(parsed.from).toBe(signer.address);
|
||||
expect(parsed.hash).toBe(Transaction.from(raw).hash);
|
||||
});
|
||||
|
||||
test("accepts a contract creation with no recipient", async () => {
|
||||
const params = { to: undefined, value: "0x0", data: "0x600160005500" };
|
||||
const raw = await signedFor(params);
|
||||
expect(() => verifySignedTx(raw, params, signer.address)).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts an absent value as zero", async () => {
|
||||
const approved = { to: RECIPIENT, data: "0x" };
|
||||
const raw = await signedFor(approved);
|
||||
expect(() =>
|
||||
verifySignedTx(raw, approved, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts call data whose case differs from the approval", async () => {
|
||||
const approved = { to: RECIPIENT, value: "0x0", data: "0xDEADBEEF" };
|
||||
const raw = await signedFor(approved);
|
||||
expect(() =>
|
||||
verifySignedTx(raw, approved, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("rejects a swapped recipient", async () => {
|
||||
const raw = await signedFor({
|
||||
...TX_PARAMS,
|
||||
to: OTHER_RECIPIENT,
|
||||
});
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved recipient/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects an inflated value", async () => {
|
||||
const raw = await signedFor({
|
||||
...TX_PARAMS,
|
||||
value: "0x4563918244f40000",
|
||||
});
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved value/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects substituted call data", async () => {
|
||||
const raw = await signedFor({ ...TX_PARAMS, data: "0xc0ffee" });
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/approved call data/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects a transaction signed by a different address", async () => {
|
||||
const raw = await signedFor(TX_PARAMS, other);
|
||||
expect(() => verifySignedTx(raw, TX_PARAMS, signer.address)).toThrow(
|
||||
/different address/,
|
||||
);
|
||||
});
|
||||
|
||||
test("rejects an unsigned transaction", () => {
|
||||
const unsigned = Transaction.from(txFor(TX_PARAMS)).unsignedSerialized;
|
||||
expect(() =>
|
||||
verifySignedTx(unsigned, TX_PARAMS, signer.address),
|
||||
).toThrow(/no valid signature/);
|
||||
});
|
||||
|
||||
test("rejects a missing or malformed payload", () => {
|
||||
expect(() =>
|
||||
verifySignedTx(undefined, TX_PARAMS, signer.address),
|
||||
).toThrow(/missing or malformed/);
|
||||
expect(() => verifySignedTx("nope", TX_PARAMS, signer.address)).toThrow(
|
||||
/missing or malformed/,
|
||||
);
|
||||
expect(() =>
|
||||
verifySignedTx("0xc0ffee", TX_PARAMS, signer.address),
|
||||
).toThrow(/could not be decoded/);
|
||||
});
|
||||
|
||||
test("every rejection message is a full sentence", async () => {
|
||||
const raw = await signedFor({ ...TX_PARAMS, to: OTHER_RECIPIENT });
|
||||
try {
|
||||
verifySignedTx(raw, TX_PARAMS, signer.address);
|
||||
throw new Error("expected a rejection");
|
||||
} catch (e) {
|
||||
expect(e.message).toMatch(/^[A-Z].*\.$/);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
const TYPED_DATA = JSON.stringify({
|
||||
domain: {
|
||||
name: "AutistMask Test",
|
||||
version: "1",
|
||||
chainId: 1,
|
||||
verifyingContract: OTHER_RECIPIENT,
|
||||
},
|
||||
primaryType: "Mail",
|
||||
types: {
|
||||
EIP712Domain: [
|
||||
{ name: "name", type: "string" },
|
||||
{ name: "version", type: "string" },
|
||||
{ name: "chainId", type: "uint256" },
|
||||
{ name: "verifyingContract", type: "address" },
|
||||
],
|
||||
Mail: [
|
||||
{ name: "from", type: "address" },
|
||||
{ name: "to", type: "address" },
|
||||
{ name: "contents", type: "string" },
|
||||
],
|
||||
},
|
||||
message: {
|
||||
from: signer.address,
|
||||
to: RECIPIENT,
|
||||
contents: "hello",
|
||||
},
|
||||
});
|
||||
|
||||
describe("verifySignature", () => {
|
||||
// "Hello AutistMask" as the hex string a dApp passes to personal_sign.
|
||||
const MESSAGE = "0x48656c6c6f204175746973744d61736b";
|
||||
const personalParams = {
|
||||
method: "personal_sign",
|
||||
message: MESSAGE,
|
||||
from: signer.address,
|
||||
};
|
||||
const typedParams = {
|
||||
method: "eth_signTypedData_v4",
|
||||
typedData: TYPED_DATA,
|
||||
from: signer.address,
|
||||
};
|
||||
|
||||
async function signPersonal(withWallet) {
|
||||
return (withWallet || signer).signMessage(
|
||||
Buffer.from(MESSAGE.slice(2), "hex"),
|
||||
);
|
||||
}
|
||||
|
||||
async function signTyped(withWallet) {
|
||||
const { domain, types, message } = JSON.parse(TYPED_DATA);
|
||||
delete types.EIP712Domain;
|
||||
return (withWallet || signer).signTypedData(domain, types, message);
|
||||
}
|
||||
|
||||
test("accepts a personal_sign signature from the approved address", async () => {
|
||||
const signature = await signPersonal();
|
||||
expect(verifySignature(personalParams, signature, signer.address)).toBe(
|
||||
signer.address,
|
||||
);
|
||||
});
|
||||
|
||||
test("accepts an eth_sign signature the same way", async () => {
|
||||
const signature = await signPersonal();
|
||||
const params = { ...personalParams, method: "eth_sign" };
|
||||
expect(() =>
|
||||
verifySignature(params, signature, signer.address),
|
||||
).not.toThrow();
|
||||
});
|
||||
|
||||
test("accepts a typed data signature from the approved address", async () => {
|
||||
const signature = await signTyped();
|
||||
expect(verifySignature(typedParams, signature, signer.address)).toBe(
|
||||
signer.address,
|
||||
);
|
||||
});
|
||||
|
||||
test("does not mutate the approved typed data while verifying", async () => {
|
||||
const signature = await signTyped();
|
||||
const before = typedParams.typedData;
|
||||
verifySignature(typedParams, signature, signer.address);
|
||||
expect(typedParams.typedData).toBe(before);
|
||||
expect(
|
||||
JSON.parse(typedParams.typedData).types.EIP712Domain,
|
||||
).toBeDefined();
|
||||
});
|
||||
|
||||
test("rejects a personal_sign signature from a different address", async () => {
|
||||
const signature = await signPersonal(other);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a typed data signature from a different address", async () => {
|
||||
const signature = await signTyped(other);
|
||||
expect(() =>
|
||||
verifySignature(typedParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a signature over a different message", async () => {
|
||||
const signature = await signer.signMessage(
|
||||
Buffer.from("00112233", "hex"),
|
||||
);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, signature, signer.address),
|
||||
).toThrow(/different address/);
|
||||
});
|
||||
|
||||
test("rejects a missing or malformed signature", async () => {
|
||||
expect(() =>
|
||||
verifySignature(personalParams, undefined, signer.address),
|
||||
).toThrow(/missing or malformed/);
|
||||
expect(() =>
|
||||
verifySignature(personalParams, "0x1234", signer.address),
|
||||
).toThrow(/could not be verified/);
|
||||
});
|
||||
});
|
||||
|
||||
// End-to-end over the messaging boundary, without a browser: run the exact
|
||||
// sequence the approval popup runs, then hand the artifact to the exact check
|
||||
// the background runs before it broadcasts or resolves. Only what the popup
|
||||
// puts on the wire is passed along, so this also pins down that the wire
|
||||
// payload is sufficient on its own.
|
||||
describe("popup signing sequence to background verification", () => {
|
||||
// Stand-in for the JSON-RPC provider. populateTransaction only needs the
|
||||
// nonce, the gas estimate, the network and the fee data.
|
||||
const fakeProvider = {
|
||||
getNetwork: async () => Network.from(1),
|
||||
getTransactionCount: async () => 7,
|
||||
estimateGas: async () => 21000n,
|
||||
getFeeData: async () => ({
|
||||
gasPrice: 2000000000n,
|
||||
maxFeePerGas: 2000000000n,
|
||||
maxPriorityFeePerGas: 1000000000n,
|
||||
}),
|
||||
};
|
||||
|
||||
// A private-key wallet as it is persisted in state, so the test goes
|
||||
// through getSignerForAddress() the way the popup does.
|
||||
const walletData = { type: "privkey" };
|
||||
|
||||
async function popupSignsTx(txParams) {
|
||||
const localSigner = getSignerForAddress(walletData, 0, SIGNER_KEY);
|
||||
const connected = localSigner.connect(fakeProvider);
|
||||
const populated = await connected.populateTransaction(txParams);
|
||||
delete populated.from;
|
||||
return connected.signTransaction(populated);
|
||||
}
|
||||
|
||||
test("a populated, signed transaction is accepted and broadcastable", async () => {
|
||||
const rawSignedTx = await popupSignsTx(TX_PARAMS);
|
||||
const parsed = verifySignedTx(rawSignedTx, TX_PARAMS, signer.address);
|
||||
expect(parsed.nonce).toBe(7);
|
||||
expect(parsed.chainId).toBe(1n);
|
||||
expect(parsed.gasLimit).toBe(21000n);
|
||||
expect(parsed.to).toBe(RECIPIENT);
|
||||
expect(parsed.value).toBe(BigInt(TX_PARAMS.value));
|
||||
expect(parsed.data).toBe(TX_PARAMS.data);
|
||||
expect(parsed.signature).not.toBeNull();
|
||||
});
|
||||
|
||||
test("the wire payload carries no password and no secret", async () => {
|
||||
const rawSignedTx = await popupSignsTx(TX_PARAMS);
|
||||
const payload = {
|
||||
type: "AUTISTMASK_TX_RESPONSE",
|
||||
id: "test-approval-id",
|
||||
approved: true,
|
||||
rawSignedTx,
|
||||
};
|
||||
expect(Object.keys(payload).sort()).toEqual([
|
||||
"approved",
|
||||
"id",
|
||||
"rawSignedTx",
|
||||
"type",
|
||||
]);
|
||||
const wire = JSON.stringify(payload).toLowerCase();
|
||||
expect(wire).not.toContain("password");
|
||||
expect(wire).not.toContain(SIGNER_KEY.slice(2).toLowerCase());
|
||||
});
|
||||
|
||||
test("the background rejects a transaction the popup did not approve", async () => {
|
||||
const rawSignedTx = await popupSignsTx({
|
||||
...TX_PARAMS,
|
||||
to: OTHER_RECIPIENT,
|
||||
});
|
||||
expect(() =>
|
||||
verifySignedTx(rawSignedTx, TX_PARAMS, signer.address),
|
||||
).toThrow(/approved recipient/);
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user