Skip to content

Malicious token transactions display in real transaction history #468

@jlbernal

Description

@jlbernal

Problem
There are malicious tokens that impersonate real tokens like USDC. Currently when using the core wallet, transactions made by malicious contracts are displayed as transactions against real assets. For example a fake USDC contract might create a send transaction and the wallet will list it under the real USDC asset as a transaction. In my case this caused panic thinking real funds were sent out. In the worst case I believe people might send real USDC to the bad address since it is in the history.

Expected Behavior
When viewing an asset's transaction hisotry such as USDC, the app should only show transactions for that specific asset, not all transactions that share the same symbol.

Proposed Solution
With minimal codebase knowledge it looks like this occurs because filters are created against the symbol string (WalletRecentTxs.tsx). Since it appears symbols aren't unique maybe it should rely on the token address instead for ERC?

Sample Malicious Tx
https://snowtrace.io/tx/0x3695552b24a8afd70fea6108ce1d379dc5c1d515bd8e1040532dc2c397333581
You can see a fake USDC & USDT token utilized by a malicious contract

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions