I am not entirely sure how signing and signature verification is done with Gnosis. Scouring stackoverflow, Gnosis documentation and discord has left me more confused than anything. I am trying to make my login support Gnosis Safe via Walletconnect
1. Signing:
I've done the following:
// Front-end Signing method:
let signature
try {
signature = await provider.request({ method: 'personal_sign', params: [message, wallet], jsonrpc: '2.0' })
} catch (e) {
// User refused to sign.
console.error(e)
signature = null
}
On login, the user copies the QRcode and pastes it into WalletConnect app on Gnosis' website.
Now at this point we note that Gnosis Safe asks the user to sign our message and that upon signing the message personal_sign
will return 0x
.
In any case this is normal.
Now we want to verify the signature and this is were the trouble begins.
2. Verifying the signature at the backend:
// Function in backend checking if the signature is valid:
const { message, signature, wallet } = req.body
// Signature is `0x` therefore we likely are trying to login using a multiSig.
if (signature == '0x' ) {
let msgHash = ethers.utils.hashMessage(message)
const magicValue = '0x1626ba7e'
const contract = gnosisSafeContract(wallet, provider) // function that returns a ethers.Contract instance
const _signature = ?????????
const value = await contract.isValidSignature(msgHash,_signature)
return value == magicValue
}
At this point I realise my question is almost a duplicate of this stackoverflow post but the "solution" isn't really a solution.
Three questions:
- How does one obtain the signature to then use
isValidSignature
? - Some people say to use
contract.signMessage
to generate a transaction rather thanpersonal_sign
but signMessage will just revert given we don't have a signer yet. How does the front end know to call metamask or x provider since the user isn't logged in yet? - Even if one were to use
signMessage
, thesignMessage
function doesn't return a signature.
I deployed a safe on rinkeby and it is the one I've been using to figure this out. https://rinkeby.etherscan.io/address/0x8390Ac0155FFC8a373F0Fd725cc15CD0841ED91B#code
I definitely need help.