This repository has been archived by the owner on Nov 6, 2020. It is now read-only.
Address inputs in non edit mode should accept addresses #3008
Labels
F1-security 🛡
The client fails to follow expected, security-sensitive, behaviour.
Milestone
Warning: The following issue can lead to disasters for normal users.
Disaster = unexpected replacement of the address they typed by 0x0 and of contracts with 0x0 instead of the address they intended.
The address input has 2 modes:
In various places, I noticed that the mode is set by default to either edit or search depending on the context. That´s fine.
I would propose the following:
Not doing so is confusing for the user who types a valid address.
The user would see the following:
which looks OK for normal users.
However, since we are in 'search' mode and the address is a good one but not in the list of know addresses, the address that will be used when calling the contract will not be the one the user sees, but 0x0 instead.
The text was updated successfully, but these errors were encountered: