1

I want to make a page that uses the user's account address to release certain private content for him/her. The idea is to get that information from metamask. I would like to know if there is any security risk in this? That is, if it is possible for the user to simulate an account address and access someone else's content.

Otherwise, does anyone know the best way to do what I want? Allow a user to access certain content only if he/she has the private key for a certain account address. Any best practice?

1 Answer 1

1

This is a nice approach, but it is very dangerous! When you fetch the account address from Metamask you can't be sure that it is correct.

Let's have a look at the following code (standard way to get selected account from Metamask - see https://docs.metamask.io/guide/accessing-accounts.html):

<!--

run this file with:
python2 -m SimpleHTTPServer 8000

then open in browser:
http://localhost:8000/scratch.html

-->

<!DOCTYPE html>
<meta content="text/html;charset=utf-8" http-equiv="Content-Type">
<meta content="utf-8" http-equiv="encoding">
<html>
<head>
    <title>Selected Account in MetaMask</title>
    <link rel="shortcut icon" href="../favicon.ico"/>
    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/web3.min.js"></script>
    <script>

        function logSelectedAddress() {
            console.log("logSelectedAddress()\nwindow.ethereum.selectedAddress -> " + window.ethereum.selectedAddress);
        }

        function changeSelectedAddress() {
            window.ethereum.selectedAddress = "0x1234567890123456789012345678901234567890"
            console.log("changeSelectedAddress()\nwindow.ethereum.selectedAddress -> " + window.ethereum.selectedAddress);
        }

    </script>
</head>
<body>
<button onclick="logSelectedAddress()">Load Address from Metamask</button>
<button onclick="changeSelectedAddress()">Change Address</button>
</body>
</html>
  1. Run this file with: python2 -m SimpleHTTPServer 8000
  2. Open in browser: http://localhost:8000/scratch.html
  3. Load the page and connect to your Metamask account
  4. Press button "Load Address from Metamask"
  5. Press button "Change Address"
  6. Press button "Load Address from Metamask"

The expected result in your browser:

enter image description here

Conclusion

Till step (4) everything looks ok, but then the code executed in step (5) overwrites the selected account. This could happen in the console or with a cross site scripting (XSS). So, everyone can pretend to have each possible account.

The only secure way would be to sign and execute a transaction with this account, but here we have considerable costs with every authentication.

2
  • Thx. I believe I can send a message to MataMask to sign, then I recover the public key via the signature, and so I can use session or tokens to authenticate the user. No gas fee. Mar 21, 2022 at 22:31
  • Your code did not load any address from the metamask
    – alper
    May 9, 2022 at 18:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.