Teacher
Professional
- Messages
- 2,669
- Reaction score
- 819
- Points
- 113
The creator of DEX Uniswap, Hayden Adams, spoke about a new vector of attacks on cryptocurrency users using the Ethereum Name Service (ENS).
The entrepreneur discovered that someone had bought an ENS domain in the form of his Ethereum address 0x11E4857Bb9993a50c685A79AFad4E6F65D518DDa.
As a result, in some interfaces, the preferred search option is 0x11E4857Bb9993a50c685A79AFad4E6F65D518DDa.eth, which is linked to a completely different wallet.
ENS domains allow you to use easily readable addresses instead of multi-digit numbers. So, for Hayden himself, this is hayden.eth, and, for example, for the founder of Ethereum, Vitalik Buterin, vitalik. eth.
"Fun fact: it was because of this possible scam vector that we initially closed registration and permissions for all 0x addresses back in the early days of MEW," commented Taylor Monahan of MetaMask, formerly a member of the MyEtherWallet wallet team.
ENS lead developer Nick Johnson of the Ethereum Foundation noted that interfaces should not, in principle, automatically fill in the address field, as this is "too dangerous".
"I think we don't recommend doing this in our UX guidelines," he added.
first time I've seen this scam, so posting it as a heads up for users and interfaces
someone bought the ens "[myEthereumAddress].eth"
so when you paste in my address, the top result in some UIs is an ens match instead of the resolved ENS name
impt for UIs to filter these out pic.twitter.com/0cQAL5tQ0T
— hayden.eth (@haydenzadams) February 14, 2024
The entrepreneur discovered that someone had bought an ENS domain in the form of his Ethereum address 0x11E4857Bb9993a50c685A79AFad4E6F65D518DDa.
As a result, in some interfaces, the preferred search option is 0x11E4857Bb9993a50c685A79AFad4E6F65D518DDa.eth, which is linked to a completely different wallet.
ENS domains allow you to use easily readable addresses instead of multi-digit numbers. So, for Hayden himself, this is hayden.eth, and, for example, for the founder of Ethereum, Vitalik Buterin, vitalik. eth.
cc @nicksdjohnson @spencecoin
fun fact: this scam vector is why we originally broke registrations & resolutions for all 0x… names in the early MEW days (in addition to rugging a slew of vanilla js hex handling bugs/vulns)
— Tay (@tayvano_) February 14, 2024
"Fun fact: it was because of this possible scam vector that we initially closed registration and permissions for all 0x addresses back in the early days of MEW," commented Taylor Monahan of MetaMask, formerly a member of the MyEtherWallet wallet team.
ENS lead developer Nick Johnson of the Ethereum Foundation noted that interfaces should not, in principle, automatically fill in the address field, as this is "too dangerous".
IMO, interfaces shouldn't autocomplete names at all; it's far too dangerous. I think we advise against it in our UX guidelines.
— nick.eth (@nicksdjohnson) February 14, 2024
"I think we don't recommend doing this in our UX guidelines," he added.
