3

I am digging into the difference between eth_sign and personal_sign.

What I found is that personal_sign is way more secure than eth_sign.

why?

eth_sign encrypts message with the user's private key and return the raw data. malicious dapp could take the data and send a transaction.

In contrast to eth_sign,

personal_sign avoid this problem since it add "\x19Ethereum Signed Message:\n" as prefix data to the user's data.

However, I have no idea of how the prefix "\x19Ethereum Signed Message:\n" can be against malicious action.

Please explain this

2 Answers 2

3

Metmask's eth_sign still uses an outdated version of the modern JSON-RPC eth_sign discussed on Ethereum.org. This means that this method can be used to sign any hash which can then create a transaction on your behalf once sent to the blockchain. You can read about why it's not recommended here.

EIP 191 introduced the "\x19Ethereum Signed Message:\n" prefix to signed messages. See this quote from the eth_sign section on Ethereum.org's list of JSON-RPC methods:

By adding a prefix to the message makes the calculated signature recognizable as an Ethereum specific signature. This prevents misuse where a malicious dapp can sign arbitrary data (e.g. transaction) and use the signature to impersonate the victim.

See EIP 712 for a standardized way to sign structured data, this is compatible with EIP 191 and is a safer method of signing transactions since the data is human readable and the intent of the transaction is easily verifiable.

You can read about Metamask's current version of this method, eth_signTypedData_v4 here.

1

Malicious attacker can request the user the sign a transfer transaction that once signed, can be immediately broadcasted to the network.

updated: it seems now both eth_sign and personal_sign prepend "\x19Ethereum Signed Message:\n" for most signers.

to sign binary data to be processed on chain, in metamask, use: https://docs.metamask.io/wallet/how-to/sign-data/#use-eth_signtypeddata_v4

1
  • All nodes on all EVM chains prepend eth_sign?
    – Blissful
    Mar 6 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.