fix: stop showing incoming transactions#240
Open
ulissesferreira wants to merge 7 commits intomainfrom
Open
Conversation
Incoming/received transactions are now excluded from transaction mapping to mitigate address poisoning attacks. Only outbound transactions (send, swap, stake, unstake) are mapped and displayed to users. Changes: - TransactionsMapper: return null for Receive type in all mapping methods (#mapTransferContract, #mapTransferAssetContract, #mapTriggerSmartContract, #mapTrc20OnlyTransaction) - Updated #mapTransferAssetContract return type to Transaction | null - Updated tests to verify incoming transactions are filtered out - Updated snap.manifest.json with new shasum Refs: NEB-723
Move the 4 scattered receive-type checks from individual mapping methods (#mapTransferContract, #mapTransferAssetContract, #mapTriggerSmartContract, 1. mapTransaction: single post-dispatch check covers all raw tx types 2. mapTransactions: single check in the TRC20-only loop This reduces duplication and makes the filtering intent explicit at the dispatch level rather than buried in each mapper.
After rebasing onto the 1.24.0 release, the CHANGELOG entry was incorrectly placed under [1.24.0]. Moved it to [Unreleased] where it belongs. Rebuilt snap to update shasum.
563344f to
18dcb8d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
Incoming/received transactions pose an address poisoning risk. Attackers send small token amounts to a user's address so that their (attacker's) address -- often visually similar to a legitimate one -- appears in the user's transaction history. Users may then accidentally copy and reuse the attacker's address for future transfers.
This PR stops mapping all incoming (receive) transactions in
TransactionMapper. Only outbound transactions (send, swap, stake deposit, stake withdraw) and unknown/approval types are now mapped and returned to the client.What changed
TransactionsMapper.ts-- receive filtering is centralized at two aggregation boundaries instead of scattered across individual mappers:mapTransaction-- the switch now assigns to amappedvariable instead of returning directly, and a single post-dispatch check filters out any result withtype === TransactionType.Receive. This covers all raw transaction types (native TRX, TRC10, TRC20, staking) in one place.mapTransactions-- the TRC20-only loop (for transactions not covered by raw data) has a singlemappedTx.type !== TransactionType.Receiveguard.Individual mappers (
#mapTransferContract,#mapTransferAssetContract,#mapTriggerSmartContract,#mapTrc20OnlyTransaction) remain unchanged in their mapping logic -- they still compute the type via#computeTransactionType, but no longer contain duplicate receive checks.Staking (
StakeDeposit/StakeWithdraw) and swap transactions are not affected -- they use dedicated types that are neverReceive.TransactionsMapper.test.ts:nullTransactionType.Receiveto now assertnull/ empty resultsmapTransactionsbatch tests to reflect reduced counts (incoming transactions excluded)snap.manifest.json:shasumupdated to match the new build outputjest.config.js:CHANGELOG.md:[Unreleased] > ChangedReferences
Checklist