fix: typed data for another chain cannot be signed (closes #519)

EIP-712 has a wallet refuse typed data whose domain chainId is not the
active chain, because the signature is valid on the chain it names. The
sign screen now shows such a request with the reason on its error line
and Sign disabled, the same way it refuses a mismatched primary type.
The background checks again when the signature comes back, against the
network active then, and answers the site with that refusal instead of
the signature. A chain id is read as ethers signs it, so 1, "1" and
"0x1" are one chain. Typed data with no chainId signs as before.

Model: opus-5-5

README.md

@@ -1641,12 +1641,6 @@ view would leave a wallet one click from deletion.
       the contract's own answer is read at signing time only to be compared with
       it, and a disagreement is a refusal rather than a preference for either
       value (`src/shared/transferAmount.js`)
-    - "Sign & Send" after the active network was switched in Settings while this
-      screen was open → nothing is signed; "The active network changed after
-      this transaction was reviewed, so it was not sent. Please go back and
-      review it again." in the errors box, no screen change. The transaction
-      carries the chain id of the network the screen was shown for, so it cannot
-      be signed for another
     - "Sign & Send" (wrong password) → "Wrong password." on the password error
       line, no screen change
     - "Back" → **Send**
@@ -2166,6 +2160,13 @@ view would leave a wallet one click from deletion.
     - Typed data that states no primary type, or one other than the type it
       would be signed as, or that cannot be read → shown with the error line
       saying so and "Sign" disabled; only "Reject" remains
+    - Typed data whose domain `chainId` names a chain other than the active
+      network's → shown with the error line naming both chain ids and "Sign"
+      disabled; only "Reject" remains. EIP-712 asks for this, because the
+      signature is valid on the chain the domain names. Typed data with no
+      `chainId` is not refused. The background refuses such a signature too,
+      against the network active when the signature reaches it, and answers the
+      site with the same sentence
     - A `personal_sign` or `eth_sign` message that is not hex (`0x` or `0X` and
       an even number of hex digits, the form ethers' `getBytes` reads when
       signing) → shown as plain text, with the error line "This message is plain

src/background/index.js

@@ -22,6 +22,7 @@ const { debugFetch, log } = require("../shared/log");
 const {
     verifySignedTx,
     verifySignature,
+    typedDataChainRefusal,
     failureIsRetryable,
     describeTxFailure,
     sameAddress,
@@ -1764,7 +1765,8 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
 
         (async () => {
             try {
-                const activeAddress = await getActiveAddress();
+                const s = await getState();
+                const activeAddress = activeAddressOf(s);
                 // Same as the transaction path: the address the approval named
                 // is the one that must have signed, and a switch since then is
                 // a refusal rather than a signature from another account.
@@ -1783,6 +1785,20 @@ runtime.onMessage.addListener((msg, sender, sendResponse) => {
                     signature,
                     approval.approvedFrom,
                 );
+                // The sign screen refuses typed data whose domain names
+                // another chain. A signature for it that arrives anyway is
+                // refused here, against the network active now.
+                const sp = approval.signParams;
+                if (
+                    sp.method === "eth_signTypedData_v4" ||
+                    sp.method === "eth_signTypedData"
+                ) {
+                    const refusal = typedDataChainRefusal(
+                        JSON.parse(sp.typedData).domain,
+                        networkById(s.networkId),
+                    );
+                    if (refusal) throw new ApprovalMismatchError(refusal);
+                }
                 settleApproval(msg.id, { signature }, { holdsClaim: true });
                 sendResponse({ signature });
             } catch (e) {

src/popup/views/approval.js

@@ -12,7 +12,7 @@ const {
     formatFee,
     tokenLabel,
 } = require("./helpers");
-const { state, saveState } = require("../../shared/state");
+const { state, saveState, currentNetwork } = require("../../shared/state");
 const {
     networkById,
     networkByChainId,
@@ -46,7 +46,10 @@ const {
 const { decryptWithPassword } = require("../../shared/vault");
 const { getSignerForAddress } = require("../../shared/wallet");
 const { walletDefect } = require("../../shared/walletDefects");
-const { describeSigningFailure } = require("../../shared/approvalVerify");
+const {
+    describeSigningFailure,
+    typedDataChainRefusal,
+} = require("../../shared/approvalVerify");
 const txStatus = require("./txStatus");
 const uniswap = require("../../shared/uniswap");
 const { notify, runtimeApi, sendMessage } = require("../../shared/browserApi");
@@ -443,7 +446,8 @@ function signedPrimaryType(types) {
 // Why a signature request cannot be signed, as a sentence for the error line,
 // or null when it can. Only typed data is refused: the `primaryType` the page
 // states has to be the type ethers will sign, or this screen would name one
-// message while another is signed.
+// message while another is signed. Its domain may name no chain but the active
+// network's.
 function typedDataRefusal(sp) {
     if (sp.method === "personal_sign" || sp.method === "eth_sign") return null;
     let data;
@@ -466,7 +470,7 @@ function typedDataRefusal(sp) {
             ", so it cannot be signed."
         );
     }
-    return null;
+    return typedDataChainRefusal(data.domain, currentNetwork());
 }
 
 // The largest amount a Permit2 allowance can hold, a uint160. Permit2 treats

src/popup/views/confirmTx.js

@@ -101,10 +101,6 @@ function show(txInfo) {
     feeStatus = FEE_PENDING;
     feeWei = null;
     maxSendFees = null;
-    // The network this screen is drawn for, and the only one it sends on:
-    // Settings can switch the active network while the screen is open. The
-    // wait, success and error screens label the amount by it too.
-    txInfo.chainId = currentNetwork().chainId;
 
     const isErc20 = txInfo.token !== "ETH";
     // The raw symbol is the price-table key; the capped one is what the
@@ -494,12 +490,7 @@ async function populateVerifyAndSend(connectedSigner, tx, fees = null) {
         );
         request = await contract.transfer.populateTransaction(tx.to, amount);
     }
-    // The chain id of the network the screen was drawn for: ethers refuses to
-    // populate it for a provider on any other network.
-    const populated = await connectedSigner.populateTransaction({
-        ...request,
-        chainId: tx.chainId,
-    });
+    const populated = await connectedSigner.populateTransaction(request);
     assertWithinCeilings(populated);
     return connectedSigner.sendTransaction(populated);
 }
@@ -556,17 +547,6 @@ function init(_ctx) {
             return;
         }
 
-        // Back from Settings only unhides this screen, still drawn for the
-        // network that was active when it was shown.
-        if (currentNetwork().chainId !== pendingTx.chainId) {
-            showSendError(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-            return;
-        }
-
         const password = $("confirm-tx-password").value;
         if (!password) {
             showError(
@@ -595,6 +575,10 @@ function init(_ctx) {
         $("btn-confirm-send").disabled = true;
         $("btn-confirm-send").classList.add("text-muted");
 
+        // The network it is sent on. The wait, success and error screens
+        // label its amount by this, not by the network active when they draw.
+        pendingTx.chainId = currentNetwork().chainId;
+
         let tx;
         try {
             const signer = getSignerForAddress(

src/shared/approvalVerify.js

@@ -53,6 +53,7 @@ const {
     accessListify,
     formatEther,
     getAddress,
+    getBigInt,
     getBytes,
     toQuantity,
     verifyMessage,
@@ -635,6 +636,33 @@ function verifySignature(signParams, signature, expectedFrom) {
     return recovered;
 }
 
+// Why typed data cannot be signed while `network` is the active network, as a
+// sentence, or null when it can. EIP-712 has a wallet refuse typed data whose
+// domain names another chain, because the signature is valid on that chain.
+// ethers signs no chain id when the domain's is null or absent, and reads any
+// other with getBigInt(), so 1, "1" and "0x1" are the same chain here too.
+function typedDataChainRefusal(domain, network) {
+    const chainId = domain?.chainId;
+    if (chainId === undefined || chainId === null) return null;
+    let named;
+    try {
+        named = getBigInt(chainId);
+    } catch {
+        return "This typed data cannot be read, so it cannot be signed.";
+    }
+    const active = getBigInt(network.chainId);
+    if (named === active) return null;
+    return (
+        "This typed data is for chain id " +
+        named +
+        ", but the active network is " +
+        network.name +
+        " (chain id " +
+        active +
+        "), so it cannot be signed."
+    );
+}
+
 // The stage a transaction approval failed at. Which stage it is decides
 // whether the approval survives the failure.
 const TX_STAGE_SIGN = "sign";
@@ -796,6 +824,7 @@ function describeSigningFailure(response, fallbackMessage) {
 module.exports = {
     verifySignedTx,
     verifySignature,
+    typedDataChainRefusal,
     assertNoForbiddenFields,
     assertNothingUnchecked,
     assertCanonicalBytes,

tests/backgroundApproval.test.js

@@ -397,7 +397,13 @@ function loadBackground(options) {
                 rpcResult = r;
             },
         );
-        return { result: () => rpcResult };
+        return {
+            id: () =>
+                new URL(created[created.length - 1].url).searchParams.get(
+                    "approval",
+                ),
+            result: () => rpcResult,
+        };
     }
 
     // A dApp asking to connect. The origin defaults to one the persisted
@@ -1484,6 +1490,55 @@ describe("what the approval is verified against", () => {
         });
     });
 
+    // Typed data whose domain names another chain is refused on the sign
+    // screen; a signature for it that reaches the background anyway is not
+    // handed to the page (https://git.eeqj.de/sneak/AutistMask/issues/519).
+    // TYPED_DATA names mainnet.
+    async function answerTypedData(bg, pending) {
+        const { domain, types, message } = JSON.parse(TYPED_DATA);
+        delete types.EIP712Domain;
+        const signature = await signer.signTypedData(domain, types, message);
+        const answer = bg.send(
+            {
+                type: "AUTISTMASK_SIGN_RESPONSE",
+                id: pending.id(),
+                approved: true,
+                signature,
+            },
+            { url: bg.fromPopup.url },
+        );
+        await settle();
+        return { answer, signature };
+    }
+
+    test("typed data for the active chain is handed back signed", async () => {
+        const bg = loadBackground();
+        const pending = bg.requestTypedData();
+        await settle();
+
+        const { answer, signature } = await answerTypedData(bg, pending);
+
+        expect(answer.sendResponse).toHaveBeenCalledWith({ signature });
+        expect(pending.result()).toEqual({ result: signature });
+    });
+
+    test("typed data for another chain is refused, not handed back", async () => {
+        const bg = loadBackground();
+        bg.setNetwork(SEPOLIA);
+        const pending = bg.requestTypedData();
+        await settle();
+
+        const { answer } = await answerTypedData(bg, pending);
+
+        const refusal =
+            "This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
+        expect(answer.sendResponse).toHaveBeenCalledWith({
+            error: refusal,
+            retryable: false,
+        });
+        expect(pending.result()).toEqual({ error: { message: refusal } });
+    });
+
     test("a sign request from another address raises no approval at all", async () => {
         const bg = loadBackground();
         const pending = bg.requestSign(other.address);

tests/confirmTxNetworkSwitch.test.js

@@ -1,259 +0,0 @@
-// A transfer is sent only on the network its confirmation screen was drawn for
-// (https://git.eeqj.de/sneak/AutistMask/issues/524).
-//
-// Settings is reachable from the confirmation screen, and Back from it only
-// unhides the screen, still labelled for the network it was drawn for. Sign &
-// Send used to take the network at the moment of the click, so 1 SepoliaETH
-// reviewed on Sepolia went out as 1 ETH on mainnet once mainnet was chosen in
-// Settings in between.
-//
-// Driven through the real confirmation screen, signer and chain switch, with
-// only the node and the DOM stubbed. The stub node is on the network its
-// provider was built for, so a broadcast records the network it went to.
-
-"use strict";
-
-// The signed transactions the stub node was handed, with its network's chain id.
-const mockNode = { broadcast: [] };
-
-jest.mock("ethers", () => {
-    const actual = jest.requireActual("ethers");
-    class StubProvider {
-        constructor(url, network) {
-            this.network = network;
-        }
-        async getNetwork() {
-            return this.network;
-        }
-        async getFeeData() {
-            return {
-                maxFeePerGas: 20000000000n,
-                maxPriorityFeePerGas: 1000000000n,
-                gasPrice: 10000000000n,
-            };
-        }
-        async estimateGas() {
-            return 21000n;
-        }
-        async getCode() {
-            return "0x";
-        }
-        async getTransactionCount() {
-            return 1;
-        }
-        async lookupAddress() {
-            return null;
-        }
-        async broadcastTransaction(signed) {
-            mockNode.broadcast.push({ chainId: this.network.chainId, signed });
-            return { hash: "0x" + "ab".repeat(32) };
-        }
-    }
-    return { ...actual, JsonRpcProvider: StubProvider };
-});
-
-jest.mock("../src/shared/log", () => ({
-    log: {
-        debugf: () => {},
-        infof: () => {},
-        warnf: () => {},
-        errorf: () => {},
-    },
-    debugFetch: jest.fn(async () => ({
-        ok: true,
-        status: 200,
-        json: async () => ({ items: [] }),
-    })),
-    urlOrigin: () => "",
-    setRuntimeDebug: () => {},
-    isDebug: () => false,
-}));
-
-// The wait screen polls for a receipt; these tests stop at the broadcast.
-jest.mock("../src/popup/views/txStatus", () => ({
-    showWait: jest.fn(),
-    showError: jest.fn(),
-}));
-
-global.fetch = jest.fn(() => {
-    throw new Error("tests must not perform network requests");
-});
-
-const { makeStorageStub } = require("./support/storageStub");
-global.chrome = { storage: makeStorageStub(), runtime: { sendMessage() {} } };
-
-// A stub DOM: every id resolves to a recording element.
-const elements = new Map();
-
-function makeEl(id) {
-    const handlers = new Map();
-    return {
-        id,
-        textContent: "",
-        innerHTML: "",
-        value: "",
-        disabled: false,
-        style: {},
-        dataset: {},
-        classList: {
-            add() {},
-            remove() {},
-            toggle() {},
-            contains: () => false,
-        },
-        handlers,
-        addEventListener(name, fn) {
-            handlers.set(name, fn);
-        },
-        querySelectorAll: () => [],
-        querySelector: () => null,
-        remove() {},
-        focus() {},
-    };
-}
-
-global.document = {
-    getElementById(id) {
-        if (!elements.has(id)) elements.set(id, makeEl(id));
-        return elements.get(id);
-    },
-    createElement: (tag) => makeEl(tag),
-    body: { prepend() {}, appendChild() {} },
-    addEventListener() {},
-};
-global.navigator = { clipboard: { writeText() {} } };
-
-const { BaseWallet, Transaction, Wallet } = require("ethers");
-const { encryptWithPassword } = require("../src/shared/vault");
-const { state, loadState } = require("../src/shared/state");
-const { onChainSwitch } = require("../src/shared/chainSwitch");
-const { NETWORKS } = require("../src/shared/networks");
-const txStatus = require("../src/popup/views/txStatus");
-const confirmTx = require("../src/popup/views/confirmTx");
-
-const PRIVATE_KEY = "0x" + "11".repeat(32);
-const HOLDER = new Wallet(PRIVATE_KEY).address;
-const RECIPIENT = "0xC0FfEE0000000000000000000000000000c0fFEe";
-const PASSWORD = "correct horse battery staple";
-
-function el(id) {
-    return global.document.getElementById(id);
-}
-
-let encryptedSecret;
-let signTransaction;
-
-beforeAll(async () => {
-    await loadState();
-    encryptedSecret = await encryptWithPassword(PRIVATE_KEY, PASSWORD);
-});
-
-beforeEach(() => {
-    elements.clear();
-    mockNode.broadcast = [];
-    txStatus.showWait.mockClear();
-    txStatus.showError.mockClear();
-    signTransaction = jest.spyOn(BaseWallet.prototype, "signTransaction");
-});
-
-afterEach(() => {
-    signTransaction.mockRestore();
-});
-
-// Show the confirmation screen for 1 of the native token on `networkId`, as
-// Review on the Send screen does, with its fee estimate settled.
-async function review(networkId) {
-    await onChainSwitch(networkId);
-    state.wallets = [
-        {
-            type: "key",
-            name: "Wallet 1",
-            encryptedSecret,
-            addresses: [{ address: HOLDER, balance: "5.0" }],
-        },
-    ];
-    state.selectedWallet = 0;
-    state.selectedAddress = 0;
-    confirmTx.init({});
-    confirmTx.show({
-        from: HOLDER,
-        to: RECIPIENT,
-        ensName: null,
-        amount: "1",
-        token: "ETH",
-        balance: "5.0",
-        tokenSymbol: null,
-        tokenBalance: null,
-        tokenDecimals: null,
-        max: false,
-    });
-    for (let i = 0; i < 10; i++) await new Promise((r) => setTimeout(r, 0));
-}
-
-async function signAndSend() {
-    el("confirm-tx-password").value = PASSWORD;
-    await el("btn-confirm-send").handlers.get("click")();
-}
-
-test("a transfer reviewed on Sepolia and sent goes out on Sepolia", async () => {
-    await review("sepolia");
-    expect(el("confirm-type").textContent).toBe("Native SepoliaETH transfer");
-    expect(el("btn-confirm-send").disabled).toBe(false);
-    await signAndSend();
-    expect(mockNode.broadcast).toHaveLength(1);
-    expect(mockNode.broadcast[0].chainId).toBe(11155111n);
-    expect(Transaction.from(mockNode.broadcast[0].signed).chainId).toBe(
-        11155111n,
-    );
-    expect(txStatus.showWait).toHaveBeenCalledTimes(1);
-});
-
-describe.each([
-    ["sepolia", "mainnet", "SepoliaETH"],
-    ["mainnet", "sepolia", "ETH"],
-])(
-    "a transfer reviewed on %s, with %s chosen in Settings before Sign & Send",
-    (reviewedOn, switchedTo, symbol) => {
-        test("is neither signed nor sent, and the screen says why", async () => {
-            await review(reviewedOn);
-            expect(el("confirm-type").textContent).toBe(
-                "Native " + symbol + " transfer",
-            );
-            // Settings' network select, then Back, which only unhides the
-            // screen as it was drawn.
-            await onChainSwitch(switchedTo);
-            await signAndSend();
-
-            expect(signTransaction).not.toHaveBeenCalled();
-            expect(mockNode.broadcast).toEqual([]);
-            expect(txStatus.showWait).not.toHaveBeenCalled();
-            expect(txStatus.showError).not.toHaveBeenCalled();
-            expect(el("confirm-errors").style.visibility).toBe("visible");
-            expect(el("confirm-errors").innerHTML).toContain(
-                "The active network changed after this transaction was" +
-                    " reviewed, so it was not sent. Please go back and review" +
-                    " it again.",
-            );
-        });
-    },
-);
-
-// The check in the click handler tells the user; the send itself carries the
-// chain id the screen was drawn for, so a signer on another network's node
-// cannot sign it even if the network changes after that check.
-test("the send is refused by a signer on another network's node", async () => {
-    const { getProvider } = require("../src/shared/balances");
-    const signer = new Wallet(PRIVATE_KEY).connect(
-        getProvider("https://rpc.example.invalid", "mainnet"),
-    );
-    await expect(
-        confirmTx.populateVerifyAndSend(signer, {
-            token: "ETH",
-            to: RECIPIENT,
-            amount: "1",
-            chainId: NETWORKS.sepolia.chainId,
-        }),
-    ).rejects.toThrow("transaction chainId mismatch");
-    expect(signTransaction).not.toHaveBeenCalled();
-    expect(mockNode.broadcast).toEqual([]);
-});

tests/typedDataPermit.test.js

@@ -240,6 +240,7 @@ function request(data) {
 beforeEach(() => {
     state.trackedTokens = [];
     state.wallets = [];
+    state.networkId = "mainnet";
 });
 
 describe("a token permission is warned about, naming spender and amount", () => {
@@ -532,3 +533,66 @@ describe("the sign screen refuses a mismatched primary type", () => {
         expect(node("btn-approve-sign").disabled).toBe(true);
     });
 });
+
+// EIP-712: a wallet refuses typed data whose domain names a chain other than
+// the active one, because the signature is valid on the chain it names
+// (https://git.eeqj.de/sneak/AutistMask/issues/519). The wallet is on Sepolia
+// and the site asks for a mainnet USDC Permit.
+describe("the sign screen refuses typed data for another chain", () => {
+    const REFUSAL =
+        "This typed data is for chain id 1, but the active network is Sepolia Testnet (chain id 11155111), so it cannot be signed.";
+
+    function withChainId(chainId) {
+        return { ...PERMIT, domain: { ...PERMIT.domain, chainId } };
+    }
+
+    beforeEach(() => {
+        decryptWithPassword.mockClear();
+        state.networkId = "sepolia";
+    });
+
+    test("another chain shows the error, with Sign disabled", async () => {
+        await openSignScreen(PERMIT);
+        expect(node("approve-sign-error").textContent).toBe(REFUSAL);
+        expect(node("btn-approve-sign").disabled).toBe(true);
+    });
+
+    test("Sign clicked anyway decrypts and signs nothing", async () => {
+        const sent = await openSignScreen(PERMIT);
+        node("approve-sign-password").value = "any password";
+        await click("btn-approve-sign");
+
+        expect(decryptWithPassword).not.toHaveBeenCalled();
+        expect(sent.map((msg) => msg.type)).not.toContain(
+            "AUTISTMASK_SIGN_RESPONSE",
+        );
+        expect(node("approve-sign-error").textContent).toBe(REFUSAL);
+    });
+
+    // ethers signs 1, "1" and "0x1" as the same chain id.
+    test("the chain id is refused in each form ethers signs", () => {
+        for (const chainId of [1, "1", "0x1"]) {
+            expect(typedDataRefusal(request(withChainId(chainId)))).toBe(
+                REFUSAL,
+            );
+        }
+    });
+
+    test("a chain id that is not a number is refused", () => {
+        expect(typedDataRefusal(request(withChainId("mainnet")))).toBe(
+            "This typed data cannot be read, so it cannot be signed.",
+        );
+    });
+
+    test("the active chain leaves Sign enabled", async () => {
+        await openSignScreen(withChainId("0xaa36a7"));
+        expect(node("approve-sign-error").textContent).toBe("");
+        expect(node("btn-approve-sign").disabled).toBe(false);
+    });
+
+    test("no chain id leaves Sign enabled", async () => {
+        await openSignScreen(withChainId(undefined));
+        expect(node("approve-sign-error").textContent).toBe("");
+        expect(node("btn-approve-sign").disabled).toBe(false);
+    });
+});