Skip to content

Commit

Permalink
Update EIP-6963: fix typo (#8119)
Browse files Browse the repository at this point in the history
  • Loading branch information
Thabokani authored Apr 24, 2024
1 parent 9181989 commit 601e1b3
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion EIPS/eip-6963.md
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,7 @@ The security considerations of [EIP-1193](./eip-1193.md) apply to this EIP. Impl

### Prototype Pollution of Wallet Provider objects

Browser extensions, and therefore Wallet extensions, are able to modify the contents of the page and the Provider object by design. The provider objects of various Wallets are considered a highly trusted interface to communicate transaction data. In order to prevent the page or various other extensions from modifying the interaction between the DApp and the Wallet in an unexpected way, the best practice is to "freeze" the provider discovery object by utilizing `object.freeze()` on the `EIP1193Provider` object before the wallet dispatches it in the `eip6963:announceProvider` Event. However, there are difficulties that can occur around web compatability where pages need to monkey patch the object. In scenarios like this there's a tradeoff that needs to be made between security and web compatibility that Wallet implementers are expected to consider.
Browser extensions, and therefore Wallet extensions, are able to modify the contents of the page and the Provider object by design. The provider objects of various Wallets are considered a highly trusted interface to communicate transaction data. In order to prevent the page or various other extensions from modifying the interaction between the DApp and the Wallet in an unexpected way, the best practice is to "freeze" the provider discovery object by utilizing `object.freeze()` on the `EIP1193Provider` object before the wallet dispatches it in the `eip6963:announceProvider` Event. However, there are difficulties that can occur around web compatibility where pages need to monkey patch the object. In scenarios like this there's a tradeoff that needs to be made between security and web compatibility that Wallet implementers are expected to consider.

### Wallet Imitation and Manipulation

Expand Down

0 comments on commit 601e1b3

Please sign in to comment.