BTC

$65687.007

-2.62%

ETH

$1929.393

-4.95%

BNB

$611.965

-1.79%

XRP

$1.354

-2.98%

News

MetaMask Now Adds An Extra Step That Could Help Users Avoid Attacks

3 mins mins
Prefer us on Google
metamask

MetaMask Now Adds An Extra Step That Could Help Users Avoid Attacks

MetaMask released a new 10.18.0 update to the wallet this week, which includes a change to the way that the software presents a requested setApprovalForAll permission. Granting that permission allows theΒ smart contractβ€”the code that powers NFTs andΒ decentralized appsβ€”the ability to access and transfer out all NFTs andΒ tokensΒ in a wallet.

Following the update, as security firm Wallet GuardΒ noted on Twitter, MetaMask now makes it clearer that a smart contract is requesting broad permissions, including access to any funds held within the walletβ€”a function that can be used for so-called β€œwallet drainer” exploits.

Screenshots posted to MetaMask’sΒ GitHub software development repositoryΒ show a new prompt that uses a larger font than the rest of the interface. The example text reads, β€œGive permission to access all of your BAYC?”, with an additional warning reading, β€œBy granting permission, you are allowing the following account to access your funds.”

MetaMask Software Engineer Alex Donesky wrote on GitHub on June 22 that β€œthere is some urgency to get something out there since this method is so commonly used.” He also added that the β€œtimeline is compressed,” and admitted that it wasn’t how he would approach the change if there was more time to develop it.

Indeed, the update comes following a rash of scams that are primarily spread via hacked social media accounts. In the spring, verified accounts of numerousΒ Twitter users were hijackedΒ and used to share scam links inspired by prominent NFT projects like Azuki andΒ Otherside, and steal the NFTs and tokens of users who unwittingly connected their wallets to the smart contracts.

More recently, the Twitter accounts of various NFT projects and notable collectors were hacked to share similar types of links, billing them as a free NFT or token drop. Such scams have taken place via hacked Discord and Instagram accounts as well. It has led to a debate over whether creators and projectsΒ should compensate usersΒ who lose assets via such scams.

To be clear, MetaMask’s update does not make any judgment call about the contract that users are attempting to connect to, and does not specifically call out identified scams. Furthermore, there are potentially legitimate uses for the setApprovalForAll function for certain dapps, such as on NFT marketplaces, which only further muddles the user decision.

We’ll see whether MetaMask takes this new feature further in future updates, as well as whether competing wallets will adopt similar techniques.

DISCLAIMER: The Information on this website is provided as general market commentary and does not constitute investment advice. We encourage you to do your own research before investing.

Join CoinCu Telegram to keep track of news: https://t.me/coincunews

Follow CoinCu Youtube Channel | Follow CoinCu Facebook page

Hazel

CoinCu News

4.7/5 - (820 votes)

Other Posts: