2

When asking the user to sign a transaction, Nami Wallet displays a screen with a summary showing how the user wallet gets affected (e.g. how much Ada is payed or received).

To be able to compute this summary, Nami must have a complete list of the wallet's own funds (UTxOs). Otherwise, it could be that it does not recognise own input UTxOs consumed in the transaction (input UTxOs being only referred to by the hash of the originating transaction and index).

Now, is it possible that a dApp makes a timing attack where it uses —as input of a transaction— some fresh UTxOs, payed to the users address, that the wallet, however, has not indexed yet ? A user signing the transaction would have the wrong impression that he is not spending own funds, whereas in reality the transaction could spend and transfer to a random receiver the users funds.

The only way to protect against these attacks, I see, is that the wallet needs to query the blockchain for all transaction inputs that it has not indexed, before showing the summary screen. Is this done ? I doubt it, as the screen seems to appear very quickly.

(I use Nami as an example, but this scenario could apply to any wallet.)

2
  • Why would the user think they are not spending their own funds? Obviously a user cannot sign a transaction for spending funds they do not own. Commented Dec 30, 2021 at 17:54
  • The funds spend in a transaction are referred to by a hash and an index. To know that it is part of the user's funds, the wallet must either have it in its cache or it must look up the blockchain to figure out at which address the input fund is sitting. The user can sign the transaction and it would be valid because it contains only his own funds. But a poorly designed wallet could think that these input funds do not belong to the user and display a wrong summary screen.
    – Jey
    Commented Dec 30, 2021 at 18:00

1 Answer 1

1

DApps merely prepare the transaction and invoke the wallet to get it signed and submitted to the blockchain. So I think the wallets would/should validate if the inputs of the transaction submitted by the dApp, contains just utxos indexed by the wallet and only then show the pop up asking user to sign it. The scenario would be similar to trying to send more than what a wallet contains (even without a dApp).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.