AllWalletDevs #23

Transcript

all right so uh guess we can get started um we don't have a ton of stuff on the agenda today uh but what we do have is a new EIP that's being proposed by the chain specific um addresses working group uh the link is in Discord here I'll pull it up and we can quickly go through this [Music] there we go hopefully you can see that and it's not just black I can see it awesome thank you uh yeah so this is

um a very very new proposal and I just wanted to raise it here because uh chain specific addresses are going to be a very important feature for wallets to implement um so I want to make sure that people see this and are aware of it and um can leave their comments on it uh so the idea behind this ERC is that you can um register using um uh you you create um a chain ID using instead of just using like a regular integer that somebody picks like a human um you use a a cjack hash of um some very specific variables here like the chain

name no thank you no that's a different one okay uh so chain name chain ID uh some kind of version in a bridge address um and the idea is that eventually this um chain ID uh registry will feed into the chain specific address um EIP that'll be coming down the road um I'm not an expert on this but uh please read it leave your comments and uh yeah um go for it yeah I I think this is a very important directions and there's a previous dis a lot of discussion so one thing I want to throw into the

conversation is the 2294 basically uh explicitly bound the existing uh chain ID size uh right now there's no really saying uh some people argue that uh it should be bound some said no um my proposal is um inter is inspired by what's and inherited by what was proposed by Alex and Brian basically we can say uh within certain amount uh it's traditional chain ID leaving space for future CH ID like those being hashed right um so one other compatibility problem that's uh any new scheme schema of CH ID should consider is that um if

you're using 256 uh you in 256 or a by 32 um a lot of um wallets current ly treat CH ID as a number which is inherently half of in half of in 32 basically a lot of a lot of them just doesn't think much using in32 uh and then use only the positive side a part of it so um you could end up having a lot of wallets that doesn't work with your new proposed uh CH ID the good side is that um whoever support them early are the early movers and then should get some Market reward um for the ethereum wallets working group I think

we should uh discuss uh what what's a better way to represent chain ID in the future now that we are aiming for um more and more chains I'm done talking thank you Victor I think that's a a really good point um this is definitely going to require some changes to wallets if it gets adopted um so I want to make sure that wallets are aware of it as soon as possible cool um so that's all I wanted to talk about uh this onchain registration of chain identifiers um I'm going to turn it over to Matt SE to talk about uh the wallet security

ranking hey Sam thank you can you guys hear me now you sound great okay cool uh so thank you for inviting me uh so I I don't know guys if you have like any time to read the um the blog post that we released a couple of days ago uh otherwise I can just you know tell you in a high level what are we doing at coins spec and yeah what's about this blog post I know if anyone has read it or should I just go ahead and comment about it let's start from

scratch so well for those who might have been following us we've been working on um on wallets as an internal research project at coinspect since almost two years ago uh we reported close to 100 we've sent out like close to 100 reports um to different vendors so you might have heard from us and well we've been doing other efforts in the wallet Spectrum all you know within this uh coins spec research uh framework and a few months ago we also released a a checklist a security checklist for

wallets uh that's public on our GitHub we've also received some collaboration from people from this group too uh and once we released that checklist we realized that both like end users and and people from the industry like technical people were sort of kind of asking for an L2 beats like uh wallet ranking in term of security and we started to work on that a a few months ago around like a half a year ago um and so far we have tested close to 70 wallets uh for a very

specific limited set of checks that we've been developing through this time this time and we are pretty close to the release of the actual ranking but first with this with this blog post we wanted to just um you know throw out thow throw some ideas out there and comment about the the process uh that we've been following for testing such a big amount of wallets and also to show that we've been you know following we've been trying to follow uh an as objective as possible process and trying

to keep everything as study as possible by you know bookkeeping everything um like evidences of a pass or a fail of a given check and we've been also developing our own tool to carry on the testing so that testers can do it as as fast as possible uh because it's now easy job to test like 70 wallets and well and that's pretty much it summarized uh we soon expect to be able to publish the ranking uh we are currently working on the

details of the ranking and we are polishing up some in some information um and about the the tests we realized that some wallets well some wallets allow users to or the apps to switch chain to call the switch chain method without any user authorization and the way we the way we have these checks um it was kind of harm harmful for for some wallets because they were losing a lot of points so we decided a couple of days ago we decided to split these check so that you know wallets that do it pretty

well but has that but have this problem of um allowing the apps to switch a chain automatically to not be like punished so much for this problem and well we've been adjusting our test data to to accommodate this and you should you guys should you know hear from us pretty soon and well I leave the space open for any questions that you might have that sounds awesome yeah thanks for talking about it and thanks for putting

in the work that's uh 70 wallets is a lot yeah well uh those were like 17 extension browser extension wallets and then it were like 26 mobile wallets uh both on IOS and Android and well something that we be that we decided to to work on is at least at the for the first stage to just focus on on the wallets that where that are listed on the ethereum um wallet side yeah that makes sense they it's it's a good list yeah pretty sensive and there are

some more too but we uh needed to draw the line somehow does anybody have any questions uh no just happy to see this I'm curious if are you uh can you describe any kind of checks you may have around EIP 712 signatures and maybe the the UI for those are you looking into that at all uh yes we have a couple of checks around EIP 712 um so we want be publishing the list of checks as of now but if you guys you

know go around all of our um blog posts and the checklist that we have published on our GitHub you will see a few checks uh around e712 and the thing is that we adapted most of the checks that are published to for this you know ranking and also something that I didn't mention is that since we didn't have all the the source code for most of the wallets uh it was kind of impossible for us to check some things like the you know the the cryp the crypto

implementation of some of the wallets so at least for now we decided to focus most of the checks towards like fishing protection and user protection against mostly deps malicious STS or compromised DFS but getting back to your answer about e 72 if you if you go through our documentation all all that we have published you'll see uh some information about it and and checks about it so what do you intend to like what's your goal of doing this this ranking what do you want to see from

wallets uh well first of all we it is like um public scho um ranking uh that's meant for everybody including technical people or and users to our goal is to uh help or or try to reduce the the amount of like fishing going around going on right now um a few days ago I heard of a of a someone that was fished using a permit for an erc20 and wallets can do a lot to prevent users or or to help users to

detect that they are trying to be fished or or hacked right or that they are trying to sign something uh malicious so that's that's our goal to you know put a tool out there for users to see how how their favorite wallet is performing in terms terms of security and also to try to um encourage wallet vendors to improve their score by you know or to improve their overall security by by improving the score at the same time I think that's a very admirable

goal yeah and all all this was born due to you know this internal research project that we started the coins spec uh we didn't came up with this idea at the very beginning we kind of started to realize throughout this entire process because we we we started just by you know Finding and Reporting backs then we published a checklist like a technical checklist then we realized that people was actually needing some like this not too technical but something that could reflect like easily how a wallet does in

terms of security so if any of you guys have any other questions I I'll just feel free to um contact me on Discord awesome thanks so much for coming out and talking it's appreciated all right thank you Sam thank you for the invitation does anybody else have anything they'd like to discuss cool then I guess we can wrap up this month's call early thank you all for coming out and we'll see you in a month