PoCs Check

Guide
中文

Signature Redirection Test Guide

Summary Description

The Signature Redirection Test checks if a signature request is correctly handled after a Dapp redirects to a new domain. If the wallet does not correctly handle the Origin, it may lead to phishing attacks.

Vulnerability Identification

Click the "Enable Ethereum" button on the page to connect the wallet, then click "selfdestruct send ETH" to record the current wallet's displayed Origin.

Click the "redirect" button to perform the redirection test. In the new page, click the "CONNECT" button on the card to connect the wallet.

Then, perform other signature operations on the new page, such as clicking the "REQUEST PERMISSIONS" button in the "Permissions Actions" card. Check if the Origin is correctly displayed as "https://metamask.github.io". If not, there is a vulnerability.

Solution

The wallet should correctly display the Origin of signature requests initiated by the new page after redirection.