Skip to content

Commit

Permalink
Update EIP-6963: fix typo (ethereum#8119)
Browse files Browse the repository at this point in the history
  • Loading branch information
Thabokani authored and blacksnow2 committed Jul 21, 2024
1 parent 082ee8f commit 2567d18
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion EIPS/eip-6963.md
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ The security considerations of [EIP-1193](./eip-1193.md) apply to this EIP. Impl

### Prototype Pollution of Wallet Provider objects

Browser extensions, and therefore Wallet extensions, are able to modify the contents of the page and the Provider object by design. The provider objects of various Wallets are considered a highly trusted interface to communicate transaction data. In order to prevent the page or various other extensions from modifying the interaction between the DApp and the Wallet in an unexpected way, the best practice is to "freeze" the provider discovery object by utilizing `object.freeze()` on the `EIP1193Provider` object before the wallet dispatches it in the `eip6963:announceProvider` Event. However, there are difficulties that can occur around web compatability where pages need to monkey patch the object. In scenarios like this there's a tradeoff that needs to be made between security and web compatibility that Wallet implementers are expected to consider.
Browser extensions, and therefore Wallet extensions, are able to modify the contents of the page and the Provider object by design. The provider objects of various Wallets are considered a highly trusted interface to communicate transaction data. In order to prevent the page or various other extensions from modifying the interaction between the DApp and the Wallet in an unexpected way, the best practice is to "freeze" the provider discovery object by utilizing `object.freeze()` on the `EIP1193Provider` object before the wallet dispatches it in the `eip6963:announceProvider` Event. However, there are difficulties that can occur around web compatibility where pages need to monkey patch the object. In scenarios like this there's a tradeoff that needs to be made between security and web compatibility that Wallet implementers are expected to consider.

### Wallet Imitation and Manipulation

Expand Down

0 comments on commit 2567d18

Please sign in to comment.