fix(dapps): normalize addresses to lowercase when validating signatures

fix(dapp-v2): normalize addresses to lowercase when validating signatures

chore: updates yarn.lock

fix(with-ethers): normalize addresses to lowercase for sig validation

fix(with-web3js): normalize addresses to lowercase for sig validation

Fixes #18
This commit is contained in:
Ben Kremer 2022-04-08 15:53:59 +02:00
parent c36bbd3357
commit 3a2ac70f1f
4 changed files with 115 additions and 89 deletions

View File

@ -65,6 +65,9 @@ export default function App() {
web3Provider,
} = useWalletConnectClient();
const verifyEip155MessageSignature = (message: string, signature: string, address: string) =>
utils.verifyMessage(message, signature).toLowerCase() === address.toLowerCase();
const ping = async () => {
if (typeof client === "undefined") {
throw new Error("WalletConnect Client is not initialized");
@ -150,7 +153,7 @@ export default function App() {
const hexMsg = encoding.utf8ToHex(msg, true);
const [address] = await web3Provider.listAccounts();
const signature = await web3Provider.send("personal_sign", [hexMsg, address]);
const valid = utils.verifyMessage(msg, signature) === address;
const valid = verifyEip155MessageSignature(msg, signature, address);
return {
method: "personal_sign",
address,
@ -167,7 +170,7 @@ export default function App() {
const hexMsg = encoding.utf8ToHex(msg, true);
const [address] = await web3Provider.listAccounts();
const signature = await web3Provider.send("eth_sign", [address, hexMsg]);
const valid = utils.verifyMessage(msg, signature) === address;
const valid = verifyEip155MessageSignature(msg, signature, address);
return {
method: "eth_sign (standard)",
address,
@ -198,12 +201,9 @@ export default function App() {
eip712.example.types;
const valid =
utils.verifyTypedData(
eip712.example.domain,
nonDomainTypes,
eip712.example.message,
signature,
) === address;
utils
.verifyTypedData(eip712.example.domain, nonDomainTypes, eip712.example.message, signature)
.toLowerCase() === address.toLowerCase();
return {
method: "eth_signTypedData",
address,

View File

@ -2029,10 +2029,10 @@
resolved "https://registry.yarnpkg.com/@stablelib/wipe/-/wipe-1.0.1.tgz#d21401f1d59ade56a62e139462a97f104ed19a36"
integrity sha512-WfqfX/eXGiAd3RJe4VU2snh/ZPwtSjLG4ynQ/vYzvghTh7dHFcI1wl+nrkWG6lGhukOxOsUHfv8dUXr58D0ayg==
"@stablelib/x25519@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@stablelib/x25519/-/x25519-1.0.1.tgz#bcd6132ac4dd94f28f1479e228c85b3468d6ed27"
integrity sha512-nmyUI2ZArxYDh1PhdoSCPEtlTYE0DYugp2qqx8OtjrX3Hmh7boIlDsD0X71ihAxzxqJf3TyQqN/p58ToWhnp+Q==
"@stablelib/x25519@^1.0.2":
version "1.0.2"
resolved "https://registry.yarnpkg.com/@stablelib/x25519/-/x25519-1.0.2.tgz#ae21e2ab668076ec2eb2b4853b82a27fab045fa1"
integrity sha512-wTR0t0Bp1HABLFRbYaE3vFLuco2QbAg6QvxBnzi5j9qjhYezWHW7OiCZyaWbt25UkSaoolUUT4Il0nS/2vcbSw==
dependencies:
"@stablelib/keyagreement" "^1.0.1"
"@stablelib/random" "^1.0.1"
@ -2635,46 +2635,49 @@
"@walletconnect/window-metadata" "1.0.0"
detect-browser "5.2.0"
"@walletconnect/client@2.0.0-beta.23", "@walletconnect/client@^2.0.0-beta.23":
version "2.0.0-beta.23"
resolved "https://registry.yarnpkg.com/@walletconnect/client/-/client-2.0.0-beta.23.tgz#934f91beb66ec7bb1a79afc1973fcd48481ccbc5"
integrity sha512-ATKrYpCiGkhy1ukmEgYtOPX9WJXBoyBcXSfRH7MJKibDbPkNf9eUfp4ZeGadn7YLy40qxHEdZtK2zGGikn84pQ==
"@walletconnect/client@2.0.0-beta.26", "@walletconnect/client@^2.0.0-beta.26":
version "2.0.0-beta.26"
resolved "https://registry.yarnpkg.com/@walletconnect/client/-/client-2.0.0-beta.26.tgz#c3f617c6f726e99e39b1d92857f06e0a477742de"
integrity sha512-BQNLS+kQyxOEIECwHN0sW+iF0CGWLECorSwmPGnadv/7kX3xGIEzv6mBOjBJisyIoea50RfADmKZNa//H1khxw==
dependencies:
"@walletconnect/encoding" "^1.0.0"
"@walletconnect/jsonrpc-provider" "^1.0.0"
"@walletconnect/encoding" "^1.0.1"
"@walletconnect/events" "^1.0.0"
"@walletconnect/heartbeat" "^1.0.0"
"@walletconnect/jsonrpc-provider" "^1.0.3"
"@walletconnect/jsonrpc-utils" "^1.0.0"
"@walletconnect/jsonrpc-ws-connection" "^1.0.0"
"@walletconnect/logger" "^1.0.0"
"@walletconnect/relay-api" "^1.0.2"
"@walletconnect/safe-json" "^1.0.0"
"@walletconnect/types" "^2.0.0-beta.23"
"@walletconnect/utils" "^2.0.0-beta.23"
"@walletconnect/time" "^1.0.1"
"@walletconnect/types" "^2.0.0-beta.26"
"@walletconnect/utils" "^2.0.0-beta.26"
ws "^8.3.0"
"@walletconnect/crypto@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@walletconnect/crypto/-/crypto-1.0.1.tgz#d4c1b1cd5dd1be88fe9a82dfc54cadbbb3f9d325"
integrity sha512-IgUReNrycIFxkGgq8YT9HsosCkhutakWD9Q411PR0aJfxpEa/VKJeaLRtoz6DvJpztWStwhIHnAbBoOVR72a6g==
"@walletconnect/crypto@^1.0.2":
version "1.0.2"
resolved "https://registry.yarnpkg.com/@walletconnect/crypto/-/crypto-1.0.2.tgz#3fcc2b2cde6f529a19eadd883dc555cd0e861992"
integrity sha512-+OlNtwieUqVcOpFTvLBvH+9J9pntEqH5evpINHfVxff1XIgwV55PpbdvkHu6r9Ib4WQDOFiD8OeeXs1vHw7xKQ==
dependencies:
"@walletconnect/encoding" "^1.0.0"
"@walletconnect/encoding" "^1.0.1"
"@walletconnect/environment" "^1.0.0"
"@walletconnect/randombytes" "^1.0.1"
"@walletconnect/randombytes" "^1.0.2"
aes-js "^3.1.2"
hash.js "^1.1.7"
"@walletconnect/ecies-25519@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@walletconnect/ecies-25519/-/ecies-25519-1.0.1.tgz#33d548d259aa2cd60f251167eba239ee0c0658ea"
integrity sha512-IK3bYxmYbnFicO69qehPuacwfa3dU1Lw20YdvfLg3IH/WCCmo5EKZu5puaQCXep42uReYE4CQ5gcVSC4PCOLcw==
"@walletconnect/ecies-25519@^1.0.2":
version "1.0.2"
resolved "https://registry.yarnpkg.com/@walletconnect/ecies-25519/-/ecies-25519-1.0.2.tgz#c248e2e1423328edb4a4a668c5bef19350533b7c"
integrity sha512-H5elgLjBPhsKXozo7M87Gg/FLTh/YdhCGYPuuodEreLZ0Lvow3fkiNRucqHmmllU3vJhIjUxMcbtvzseky1hSA==
dependencies:
"@stablelib/x25519" "^1.0.1"
"@walletconnect/crypto" "^1.0.1"
"@walletconnect/encoding" "^1.0.0"
"@stablelib/x25519" "^1.0.2"
"@walletconnect/crypto" "^1.0.2"
"@walletconnect/encoding" "^1.0.1"
"@walletconnect/encoding@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@walletconnect/encoding/-/encoding-1.0.0.tgz#e24190cb5e803526f9dfd7191fb0e4dc53c6d864"
integrity sha512-4nkJFnS0QF5JdieG/3VPD1/iEWkLSZ14EBInLZ00RWxmC6EMZrzAeHNAWIgm+xP3NK0lqz+7lEsmWGtcl5gYnQ==
"@walletconnect/encoding@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@walletconnect/encoding/-/encoding-1.0.1.tgz#93c18ce9478c3d5283dbb88c41eb2864b575269a"
integrity sha512-8opL2rs6N6E3tJfsqwS82aZQDL3gmupWUgmvuZ3CGU7z/InZs3R9jkzH8wmYtpbq0sFK3WkJkQRZFFk4BkrmFA==
dependencies:
is-typedarray "1.0.0"
typedarray-to-buffer "3.1.5"
@ -2684,21 +2687,36 @@
resolved "https://registry.yarnpkg.com/@walletconnect/environment/-/environment-1.0.0.tgz#c4545869fa9c389ec88c364e1a5f8178e8ab5034"
integrity sha512-4BwqyWy6KpSvkocSaV7WR3BlZfrxLbJSLkg+j7Gl6pTDE+U55lLhJvQaMuDVazXYxcjBsG09k7UlH7cGiUI5vQ==
"@walletconnect/ethereum-provider@2.0.0-beta.23":
version "2.0.0-beta.23"
resolved "https://registry.yarnpkg.com/@walletconnect/ethereum-provider/-/ethereum-provider-2.0.0-beta.23.tgz#98fb097aee541c3babeba6d08c2f9a9116cbb755"
integrity sha512-pPicgsYPAhrPrmKnFJMFNqFvG9EeYPuI5y/bfvJjBiw6FaPmMFlFcZMa7BuZ9Tu5KQ/PHep66ZvZ2CujJpfL5w==
"@walletconnect/ethereum-provider@2.0.0-beta.26":
version "2.0.0-beta.26"
resolved "https://registry.yarnpkg.com/@walletconnect/ethereum-provider/-/ethereum-provider-2.0.0-beta.26.tgz#6ea049e193e15f782919b70bf01cab12e7f124c3"
integrity sha512-gGt7ENMgpXrrxtiRZAc1dOE4IoZLU1Yu2g55jUVAY6kyTHS3Y69pR8G/7PyfLtsRnsXeUtX0HpQxz72OxC8kNw==
dependencies:
"@walletconnect/client" "^2.0.0-beta.23"
"@walletconnect/client" "^2.0.0-beta.26"
"@walletconnect/jsonrpc-http-connection" "^1.0.0"
"@walletconnect/jsonrpc-provider" "^1.0.0"
"@walletconnect/jsonrpc-provider" "^1.0.3"
"@walletconnect/jsonrpc-types" "^1.0.0"
"@walletconnect/jsonrpc-utils" "^1.0.0"
"@walletconnect/signer-connection" "^2.0.0-beta.23"
"@walletconnect/types" "^2.0.0-beta.23"
"@walletconnect/utils" "^2.0.0-beta.23"
"@walletconnect/signer-connection" "^2.0.0-beta.26"
"@walletconnect/types" "^2.0.0-beta.26"
"@walletconnect/utils" "^2.0.0-beta.26"
eip1193-provider "^1.0.1"
"@walletconnect/events@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@walletconnect/events/-/events-1.0.0.tgz#000033a52a618345713d5bd43e8780d120c5accc"
integrity sha512-LLf8krnHo+PsObwMZbGhVaG24SvGTJM0MEtPNhrlQmp27CRV+LwYpHLh7fhABcnUon4aeo7dojCJMmx5jBNWuQ==
dependencies:
keyvaluestorage-interface "^1.0.0"
"@walletconnect/heartbeat@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@walletconnect/heartbeat/-/heartbeat-1.0.0.tgz#d77d10aab467aafc45a09e25547d2158da630198"
integrity sha512-WMWbUNHVkVd7FS38P0DMDlvR38P/kSZcda94t54h8XtC1CfI2M/Cn9TGS6mC6MNuDkZZm+cOdkekibQc+9sNdQ==
dependencies:
"@walletconnect/events" "^1.0.0"
"@walletconnect/time" "^1.0.1"
"@walletconnect/jsonrpc-http-connection@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@walletconnect/jsonrpc-http-connection/-/jsonrpc-http-connection-1.0.0.tgz#5bbdfbaf6d6519b3c08e492a6badb7460ab5ecd0"
@ -2708,10 +2726,10 @@
"@walletconnect/safe-json" "^1.0.0"
cross-fetch "^3.1.4"
"@walletconnect/jsonrpc-provider@^1.0.0":
version "1.0.0"
resolved "https://registry.yarnpkg.com/@walletconnect/jsonrpc-provider/-/jsonrpc-provider-1.0.0.tgz#066ee5a8a8554c55ea68f9ebf6fe8f96cdb66e7e"
integrity sha512-ZVe23tYT0LdykZ/denBdkKCjBC13fnpj8MiKFuvUl0idBv1PiYKYJR3LVJHy8+7zk0lBbDH3hBNrbMt/K4kjcw==
"@walletconnect/jsonrpc-provider@^1.0.3":
version "1.0.3"
resolved "https://registry.yarnpkg.com/@walletconnect/jsonrpc-provider/-/jsonrpc-provider-1.0.3.tgz#ddd8dca2e17df62f0dbe42764319f61487b5cbcb"
integrity sha512-DmSBKEB+RYngQgAbbDtJTUFdgyKvnWJD8bsM2QR1e2fyEUGUaq+z3QXixrMAsMW3tI8EuVlklEd7ayb6oyFpZw==
dependencies:
"@walletconnect/jsonrpc-utils" "^1.0.0"
"@walletconnect/safe-json" "^1.0.0"
@ -2764,12 +2782,12 @@
preact "10.4.1"
qrcode "1.4.4"
"@walletconnect/randombytes@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@walletconnect/randombytes/-/randombytes-1.0.1.tgz#87f0f02d9206704ce1c9e23f07d3b28898c48385"
integrity sha512-YJTyq69i0PtxVg7osEpKfvjTaWuAsR49QEcqGKZRKVQWMbGXBZ65fovemK/SRgtiFRv0V8PwsrlKSheqzfPNcg==
"@walletconnect/randombytes@^1.0.2":
version "1.0.2"
resolved "https://registry.yarnpkg.com/@walletconnect/randombytes/-/randombytes-1.0.2.tgz#95c644251a15e6675f58fbffc9513a01486da49c"
integrity sha512-ivgOtAyqQnN0rLQmOFPemsgYGysd/ooLfaDA/ACQ3cyqlca56t3rZc7pXfqJOIETx/wSyoF5XbwL+BqYodw27A==
dependencies:
"@walletconnect/encoding" "^1.0.0"
"@walletconnect/encoding" "^1.0.1"
"@walletconnect/environment" "^1.0.0"
randombytes "^2.1.0"
@ -2785,22 +2803,29 @@
resolved "https://registry.yarnpkg.com/@walletconnect/safe-json/-/safe-json-1.0.0.tgz#12eeb11d43795199c045fafde97e3c91646683b2"
integrity sha512-QJzp/S/86sUAgWY6eh5MKYmSfZaRpIlmCJdi5uG4DJlKkZrHEF7ye7gA+VtbVzvTtpM/gRwO2plQuiooIeXjfg==
"@walletconnect/signer-connection@^2.0.0-beta.23":
version "2.0.0-beta.23"
resolved "https://registry.yarnpkg.com/@walletconnect/signer-connection/-/signer-connection-2.0.0-beta.23.tgz#ed00081aa31843f8a9d57cf2f166e00ccaf627a7"
integrity sha512-rQBs91rGKJFndYCJbb8cq7Splv58MJALjBdQBymaylhnlWjyDlnwQdAwaDabeE4vTn+FuEkYLcb4RQXMCpgMpg==
"@walletconnect/signer-connection@^2.0.0-beta.26":
version "2.0.0-beta.26"
resolved "https://registry.yarnpkg.com/@walletconnect/signer-connection/-/signer-connection-2.0.0-beta.26.tgz#487b00509a69056d003b2d8fab306e33da06606f"
integrity sha512-Viswih5kz5zZ4P1wJ+tG3OsuRQXt+/A+GDF+8Smx+vuBZhMLbt4nqGCgGnp4oWL9dnJU/23RhV1TxmnchbHH2g==
dependencies:
"@walletconnect/client" "^2.0.0-beta.23"
"@walletconnect/client" "^2.0.0-beta.26"
"@walletconnect/jsonrpc-types" "^1.0.0"
"@walletconnect/jsonrpc-utils" "^1.0.0"
"@walletconnect/types" "^2.0.0-beta.23"
"@walletconnect/utils" "^2.0.0-beta.23"
"@walletconnect/types" "^2.0.0-beta.26"
"@walletconnect/utils" "^2.0.0-beta.26"
"@walletconnect/types@2.0.0-beta.23", "@walletconnect/types@^2.0.0-beta.23":
version "2.0.0-beta.23"
resolved "https://registry.yarnpkg.com/@walletconnect/types/-/types-2.0.0-beta.23.tgz#3adf5c8329b7807d8c8d4aa1419e470eab72445c"
integrity sha512-zYn26dvp/HsZJMUCFsJoK255yLp+Z9tGIomVO4outiZM1wa0tAUwma2QzoGyKDSgK4EbsYHFcWjSUX2kqh8quQ==
"@walletconnect/time@^1.0.1":
version "1.0.1"
resolved "https://registry.yarnpkg.com/@walletconnect/time/-/time-1.0.1.tgz#645f596887e67c56522edbc2b170d46a97c87ce0"
integrity sha512-LtNtHupTNranehLMh8Z/JN6xVySysSoJNjNCQ0ML+hOUkim5QX/VdvfovSpaX9qA2b95u7bIuTcq0O3UBk7Iyw==
"@walletconnect/types@2.0.0-beta.26", "@walletconnect/types@^2.0.0-beta.26":
version "2.0.0-beta.26"
resolved "https://registry.yarnpkg.com/@walletconnect/types/-/types-2.0.0-beta.26.tgz#500599a893303556f48e6f17daf4c3362495495d"
integrity sha512-wVtgEEgBLxrmKhaZ1UqHVQgKuZiYdPF4vo910RqrSOZbbPRNBtrHY37JvhQdZKe2Ake1r1x66tPyOR+WaMp1Zg==
dependencies:
"@walletconnect/events" "^1.0.0"
"@walletconnect/heartbeat" "^1.0.0"
"@walletconnect/jsonrpc-types" "^1.0.0"
keyvaluestorage "^0.7.1"
pino "^6.7.0"
@ -2811,18 +2836,19 @@
resolved "https://registry.yarnpkg.com/@walletconnect/types/-/types-1.7.1.tgz#86cc3832e02415dc9f518f3dcb5366722afbfc03"
integrity sha512-X0NunEUgq46ExDcKo7BnnFpFhuZ89bZ04/1FtohNziBWcP2Mblp2yf+FN7iwmZiuZ3bRTb8J1O4oJH2JGP9I7A==
"@walletconnect/utils@2.0.0-beta.23", "@walletconnect/utils@^2.0.0-beta.23":
version "2.0.0-beta.23"
resolved "https://registry.yarnpkg.com/@walletconnect/utils/-/utils-2.0.0-beta.23.tgz#005e4409a7014a66dda30389e4b1f31d186ebd0e"
integrity sha512-AH38tD5P6wWo5+D+pMJYePHdu0008fI6bE8NlFy0/o7qxzCVs7GAGWnyDNSHFUg7zgu+N120jsq2mBg2bNFxLQ==
"@walletconnect/utils@2.0.0-beta.26", "@walletconnect/utils@^2.0.0-beta.26":
version "2.0.0-beta.26"
resolved "https://registry.yarnpkg.com/@walletconnect/utils/-/utils-2.0.0-beta.26.tgz#228c1f068ca42630f01bbd3c013dcfc42677cc9a"
integrity sha512-RjADvX6d8K3eqLcxFIiQDFV9ajiI7kQX4+iVV63uf5rlC+HnIX+jwIYJWlD+eR6JPmfIIskoG5/m0RqK/iphjA==
dependencies:
"@walletconnect/ecies-25519" "^1.0.1"
"@walletconnect/encoding" "^1.0.0"
"@walletconnect/ecies-25519" "^1.0.2"
"@walletconnect/encoding" "^1.0.1"
"@walletconnect/jsonrpc-utils" "^1.0.0"
"@walletconnect/logger" "^1.0.0"
"@walletconnect/relay-api" "^1.0.2"
"@walletconnect/safe-json" "^1.0.0"
"@walletconnect/types" "^2.0.0-beta.23"
"@walletconnect/time" "^1.0.1"
"@walletconnect/types" "^2.0.0-beta.26"
"@walletconnect/window-getters" "^1.0.0"
"@walletconnect/window-metadata" "^1.0.0"
lodash.union "^4.6.0"

View File

@ -64,6 +64,9 @@ export default function App() {
web3Provider,
} = useWalletConnectClient();
const verifyEip155MessageSignature = (message: string, signature: string, address: string) =>
utils.verifyMessage(message, signature).toLowerCase() === address.toLowerCase();
const ping = async () => {
if (typeof client === "undefined") {
throw new Error("WalletConnect Client is not initialized");
@ -149,7 +152,7 @@ export default function App() {
const hexMsg = encoding.utf8ToHex(msg, true);
const [address] = await web3Provider.eth.getAccounts();
const signature = await web3Provider.eth.personal.sign(hexMsg, address, "");
const valid = utils.verifyMessage(msg, signature) === address;
const valid = verifyEip155MessageSignature(msg, signature, address);
return {
method: "personal_sign",
address,
@ -166,7 +169,7 @@ export default function App() {
const hexMsg = encoding.utf8ToHex(msg, true);
const [address] = await web3Provider.eth.getAccounts();
const signature = await web3Provider.eth.sign(hexMsg, address);
const valid = utils.verifyMessage(msg, signature) === address;
const valid = verifyEip155MessageSignature(msg, signature, address);
return {
method: "eth_sign (standard)",
address,
@ -206,12 +209,9 @@ export default function App() {
eip712.example.types;
const valid =
utils.verifyTypedData(
eip712.example.domain,
nonDomainTypes,
eip712.example.message,
signature,
) === address;
utils
.verifyTypedData(eip712.example.domain, nonDomainTypes, eip712.example.message, signature)
.toLowerCase() === address.toLowerCase();
return {
method: "eth_signTypedData",

View File

@ -106,6 +106,9 @@ export function JsonRpcContextProvider({ children }: { children: ReactNode | Rea
}
};
const _verifyEip155MessageSignature = (message: string, signature: string, address: string) =>
utils.verifyMessage(message, signature).toLowerCase() === address.toLowerCase();
const ping = async () => {
if (typeof client === "undefined") {
throw new Error("WalletConnect is not initialized");
@ -232,7 +235,7 @@ export function JsonRpcContextProvider({ children }: { children: ReactNode | Rea
throw new Error(`Missing chain data for chainId: ${chainId}`);
}
const valid = utils.verifyMessage(message, signature) === address;
const valid = _verifyEip155MessageSignature(message, signature, address);
// format displayed result
return {
@ -270,7 +273,7 @@ export function JsonRpcContextProvider({ children }: { children: ReactNode | Rea
throw new Error(`Missing chain data for chainId: ${chainId}`);
}
const valid = utils.verifyMessage(message, signature) === address;
const valid = _verifyEip155MessageSignature(message, signature, address);
// format displayed result
return {
@ -303,12 +306,9 @@ export function JsonRpcContextProvider({ children }: { children: ReactNode | Rea
eip712.example.types;
const valid =
utils.verifyTypedData(
eip712.example.domain,
nonDomainTypes,
eip712.example.message,
signature,
) === address;
utils
.verifyTypedData(eip712.example.domain, nonDomainTypes, eip712.example.message, signature)
.toLowerCase() === address.toLowerCase();
return {
method: DEFAULT_EIP155_METHODS.ETH_SIGN_TYPED_DATA,