-
Couldn't load subscription status.
- Fork 16
Description
Problem
There are malicious tokens that impersonate real tokens like USDC. Currently when using the core wallet, transactions made by malicious contracts are displayed as transactions against real assets. For example a fake USDC contract might create a send transaction and the wallet will list it under the real USDC asset as a transaction. In my case this caused panic thinking real funds were sent out. In the worst case I believe people might send real USDC to the bad address since it is in the history.
Expected Behavior
When viewing an asset's transaction hisotry such as USDC, the app should only show transactions for that specific asset, not all transactions that share the same symbol.
Proposed Solution
With minimal codebase knowledge it looks like this occurs because filters are created against the symbol string (WalletRecentTxs.tsx). Since it appears symbols aren't unique maybe it should rely on the token address instead for ERC?
Sample Malicious Tx
https://snowtrace.io/tx/0x3695552b24a8afd70fea6108ce1d379dc5c1d515bd8e1040532dc2c397333581
You can see a fake USDC & USDT token utilized by a malicious contract