Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Please add wallet_getAssets method to TokenController, or silently ignore wallet_watchAssets if token already added #880

Open
hiroshi-yamamoto-dublr opened this issue Jul 25, 2022 · 0 comments

Comments

@hiroshi-yamamoto-dublr
Copy link

hiroshi-yamamoto-dublr commented Jul 25, 2022

TokenController defines a function watchAsset which implements EIP-747's wallet_getAssets.

This EIP does not specify a way to determine whether a wallet already contains the given asset. This means that a dapp connecting to MetaMask cannot automatically keep suggesting their token, otherwise users are presented with the following warning the second and subsequent time wallet_watchAssets is called, if the user added the token the first time wallet_watchAssets was called:

image

This action will edit tokens that are already listed in your wallet, which can be used to phish you. Only approve if you are certain that you mean to change what these tokens represent. Learn more about scams and security risks.

Unfortunately this warning is shown whether or not the options submitted to watchAsset exactly match a token already in the wallet.

I propose two possible solutions:

  1. Add a wallet_getAssets RPC call that returns the four options (address, symbol, decimals, image) provided to wallet_watchAssets, for all assets registered in the wallet.
  2. Silently ignore wallet_watchAssets calls if the wallet already includes a token whose options exactly match all four of the options provided to wallet_watchAssets.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants