@exodus/web3-ethereum 14.0.1 → 14.0.3

package/lib/rpc-handlers/exposeHandlers.js

@@ -66,19 +66,18 @@ const isValidGasLimitValue = (value) => {
 /*
  A `personal_sign` message, as the bytes that will actually be signed.
 
- Only a 0x-prefixed, even-length, fully hex string counts as hex. Every other shape is
- rejected rather than reinterpreted, because the approval screen is shown the raw request
- string: if the signer applies a decoding rule the screen does not, the user reads one
- message and authenticates another. Bare hex is refused for exactly that reason -- the
- screen has no 0x to strip, so it renders the digits literally while the old signer decoded
- them.
+ Only a 0x-prefixed, even-length, fully hex string decodes as hex. Every other string is
+ signed as its utf8 bytes, like MetaMask. The approval screen is shown the raw request
+ string and applies the same rule, so the user authenticates exactly what they read. Bare
+ hex therefore signs the ascii digits, because that is what the screen renders.
  */
-const PERSONAL_SIGN_MESSAGE = /^0x([0-9a-fA-F]{2})*$/;
+const HEX_PERSONAL_SIGN_MESSAGE = /^0x([0-9a-fA-F]{2})*$/;
 const decodePersonalSignMessage = (message) => {
-    if (typeof message !== 'string' || !PERSONAL_SIGN_MESSAGE.test(message)) {
+    if (typeof message !== 'string')
         throw new InvalidInputError();
-    }
-    return hex0xStringToBuffer(message);
+    return HEX_PERSONAL_SIGN_MESSAGE.test(message)
+        ? hex0xStringToBuffer(message)
+        : Buffer.from(message, 'utf8');
 };
 export function exposeHandlers(rpc, deps) {
     const { chainId, isTrusted, isAutoApproved, ensureTrusted, ensureUntrusted, approveConnection, approveMessage, approveTransactions, forwardRequest, getSupportedChainIds = async () => [], getAddress, getEstimatedGas, getCustomFeeData, getFeeData, getNonce, sendRawTransaction, simulateEthereumTransactions, scanDomains, onTransactionsSigned = () => { }, onEthWalletWatchAssetRequest = () => { }, isUnlocked = () => true, ensureUnlocked = async () => true, getIsConnected, getAsset, addEthereumChain, getOrigin, getPathname, getActiveWalletAccountData, transactionSigner, messageSigner, } = deps;
@@ -204,18 +203,7 @@ export function exposeHandlers(rpc, deps) {
         await assertTrusted();
         await ensureUnlocked();
         // The approval screen is handed this exact string, so the bytes we sign have to be
-        // derivable from it under ONE rule that the screen shares. `personal_sign` takes a
-        // 0x-prefixed hex string; the signer used to hex-decode whatever it was given, which
-        // disagreed with the screen for any message that was not 0x-prefixed hex:
-        //
-        //   `<hex of a SIWE login>`                  screen showed raw hex, we signed the login
-        //   `<hex of a SIWE login> Login only.`      screen showed the suffix, we dropped it
-        //   `Sign in to example.com`                 screen showed the text, we signed nothing
-        //
-        // Each one let a dapp put readable text in front of the user and take a signature over
-        // something else. Requiring the prefix means a string the screen renders as text can
-        // never be reinterpreted as bytes, and decoding BEFORE approval means a message we
-        // would refuse is never approved in the first place.
+        // derivable from it under ONE rule that the screen shares (see HackerOne 4003290).
         const rawMessage = decodePersonalSignMessage(message);
         await approve(approveMessage, network, message);
         const walletAccount = await getActiveWalletAccountData();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@exodus/web3-ethereum",
   "description": "Apps connectivity library for EVM-compatible chains.",
-  "version": "14.0.1",
+  "version": "14.0.3",
   "type": "module",
   "sideEffects": false,
   "module": "lib/index.js",
@@ -38,7 +38,7 @@
     "test": "exodus-test --jest --esbuild"
   },
   "dependencies": {
-    "@exodus/ethereum-api": "^9.0.0",
+    "@exodus/ethereum-api": "^10.0.0",
     "@exodus/ethereumjs": "^1.11.0",
     "@exodus/web3-constants": "^1.30.0",
     "@exodus/web3-errors": "^1.13.0",
@@ -68,5 +68,5 @@
     "url": "https://github.com/ExodusMovement/assets/issues?q=is%3Aissue+is%3Aopen+label%3Aweb3-ethereum"
   },
   "homepage": "https://github.com/ExodusMovement/assets/tree/master/web3/web3-ethereum",
-  "gitHead": "92d6cdde313e5244fb05a99b1be964a96f989c3b"
+  "gitHead": "7b9cb0164f443d87efabbf5a5dcb186d7fe3200c"
 }