Clearing up the reason behind "Ethereum Signed Message"#8828
Conversation
|
It looks like @elichai hasn't signed our Contributor License Agreement, yet.
You can read and sign our full Contributor License Agreement at the following URL: https://cla.parity.io Once you've signed, please reply to this thread with Many thanks, Parity Technologies CLA Bot |
|
[clabot:check]. |
|
It looks like @elichai signed our Contributor License Agreement. 👍 Many thanks, Parity Technologies CLA Bot |
5chdn
added
A2-insubstantial 👶
| /// Returns a eth_sign-compatible hash of data to sign. | ||
| /// The data is prepended with special message to prevent | ||
| /// chosen-plaintext attacks. | ||
| /// malicious DApps from using the function to sign forge transactions. |
There was a problem hiding this comment.
Fixed. Don't know how it happened 👍
| // produce a corpus from the vector and cache it. | ||
| // It's later used to get a percentile for default gas price. | ||
| let corpus: ::stats::Corpus<_> = prices.into(); | ||
| let corpus: ::stats::Corpus<_> =forge prices.into(); |
There was a problem hiding this comment.
I guess this is mistake?
niklasad1
left a comment
niklasad1
left a comment
There was a problem hiding this comment.
Revert the changes in rpc/src/v1/helpers/dispatch.rs and it's good to merge!
niklasad1
added
the
A5-grumble 🔥
elichai
force-pushed
the
master
branch
2 times, most recently
from
bb675e4 to
46bf82e
Compare
|
Reverted. now it's good and clean. |
niklasad1
added
A8-looksgood 🦄
* master: Fix subcrate test compile (#8862) network-devp2p: downgrade logging to debug, add target (#8784) Clearing up a comment about the prefix for signing (#8828) Disable parallel verification and skip verifiying already imported txs. (#8834) devp2p: Move UDP socket handling from Discovery to Host. (#8790) Fixed AuthorityRound deadlock on shutdown, closes #8088 (#8803) Specify critical release flag per network (#8821) Fix `deadlock_detection` feature branch compilation (#8824) Use system allocator when profiling memory (#8831) added from and to to Receipt (#8756)
5 participants
I think this makes more sense.
First because there aren't really chosen-plaintext attacks against asymmetric encryption keys out there.
Second because faking a transaction to be signed by the user is a viable attack vector.