Comments (9)
If we don't not encode txBody, for person_sign
, we could get something like:
eip712, we could get something like:
from kwil-db.
#132 even in cosmos account, we still need this
from kwil-db.
![Screenshot 2023-08-29 at 4 25 00 PM](https://private-user-images.githubusercontent.com/4044847/264178195-a841470f-e650-474a-8a37-081ee2fddee8.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjQzMzI2MjIsIm5iZiI6MTcyNDMzMjMyMiwicGF0aCI6Ii80MDQ0ODQ3LzI2NDE3ODE5NS1hODQxNDcwZi1lNjUwLTQ3NGEtOGEzNy0wODFlZTJmZGRlZTgucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDgyMiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA4MjJUMTMxMjAyWiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9OGY1MWVhYzI1MjYzYTg4YTliOGYwN2Q0NjJjYTk2NGRhOWJiOTVkNDI0MWQ5ZjYwODVlYjU4ZGU5NTM5ZDEwZiZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.EZfqC3sin7T9fRO7wj6-iUyrz_nLXUIRYsjgVlHlyts)
This diagram shows how a message got transformed to a Tx.
We can see that encoding happens two times:
a. data being signed is encoded
b. actually payload is encoded
a) will cause personal_sign
gives out a message to sign just like in the description
b) will cause payload
always non-readable, which is also a crucial filed for the message to sign. Even for eip712.
So unless we don't encode payload
, in best scenario, we can get something like below:
@brennanjl @KwilLuke @jchappelow
from kwil-db.
So even with eip 712 there's still a not-human-readable blob, correct? I don't think that screen quite makes sense since there's a "signature_bytes"
which they obviously would not be signing. Still we can make this friendly.
Here's my experience with personal sign in a variety of web3 apps:
Signing into llamanodes (an RPC provider with web3 sign in)
Signing into blast (also an RPC provider)
Signing into Omnia
That one is almost identical to Llama, but with a request ID.
Async art connect
The point
In all cases, it's 90% human readable, free form definition apparently, with a small "token" or otherwise meaningless character string.
Can we not also make our message quite friendly like this in whatever textual template we like, and reduce both the payload+nonce with a hash and embed even a 16 byte token derived from the hash in our human readable message?
In all cases, the user is inevitably going to be signing something that includes a small piece of info that is meaningless to a human, but we can minimize that and make a lot of friendly text around it. The end result is that they understand it's for a Kwil request and that they are not signing a transaction or giving away some tokens (it should say "Kwil" message, include ephemeral data, readable fee, etc).
from kwil-db.
To clarify, that payload
is the base64 encoding (text) of the rlp encoding of some procedure/action? I am still thinking that rlp makes the most sense as an efficient deterministic encoding for storage in the blockchain, but I'm not totally clear why frontend/client sdk needs to also do it.
from kwil-db.
So even with eip 712 there's still a not-human-readable blob, correct? I don't think that screen quite makes sense since there's a
"signature_bytes"
which they obviously would not be signing. Still we can make this friendly.Here's my experience with personal sign in a variety of web3 apps:
Signing into llamanodes (an RPC provider with web3 sign in)
Signing into blast (also an RPC provider)
Signing into Omnia
That one is almost identical to Llama, but with a request ID.
Async art connect
The point
In all cases, it's 90% human readable, free form definition apparently, with a small "token" or otherwise meaningless character string.
Can we not also make our message quite friendly like this in whatever textual template we like, and reduce both the payload+nonce with a hash and embed even a 16 byte token derived from the hash in our human readable message?
In all cases, the user is inevitably going to be signing something that includes a small piece of info that is meaningless to a human, but we can minimize that and make a lot of friendly text around it. The end result is that they understand it's for a Kwil request and that they are not signing a transaction or giving away some tokens (it should say "Kwil" message, include ephemeral data, readable fee, etc).
Yeah i'm actually going to change the personal_sign
so that user will sign a message like:
You're signing a kwil message: *&^#*)@^$#@
Later, in eip712(we cannot encode txBody), we'll be able to let user sign something like:
{ payload: "#@#@#", payloadType: "deploy_schema", fee: 10, nonce: 3 }
As long as we encode payload
, payload
will not be readable,
from kwil-db.
To clarify, that
payload
is the base64 encoding (text) of the rlp encoding of some procedure/action? I am still thinking that rlp makes the most sense as an efficient deterministic encoding for storage in the blockchain, but I'm not totally clear why frontend/client sdk needs to also do it.
That's because we are actually signing the txBody
, and payload
is a filed of byte(which we encoded in rlp).
We can actually not rlpEncode txBody, instead just format and concatenate those fields, we could get something like what we could get from eip712:
`
You're singing a kwil message:
payload: "#@$#@$"
payloadType: "deploy_schema"
fee: 10
nonce: 3
`
@brennanjl
from kwil-db.
AFAIK this got closed, unless you meant for this to include eip712 @Yaiba
from kwil-db.
AFAIK this got closed, unless you meant for this to include eip712 @Yaiba
Yes i guess we can consider this is resolved, #241 supports a structured template message.
I'll create issue dedicated to eip712 later if we need it.
from kwil-db.
Related Issues (20)
- provide an advanced DB interface for internals HOT 2
- action view_by_range: interface conversion: interface {} is *parse.ExpressionVariable, not *parse.ExpressionLiteral HOT 1
- action add_nganh: (action) undeclared variable: $tenkhoa HOT 4
- Documentation: Clarify Extension Error Returns
- Feature: Block data in extensions HOT 4
- integration test: create tests for state sync and genesis_state
- apparent hang with bad rpc_servers setting HOT 3
- Feature: Fail Fast on missing resolution
- apphash mismatch on every restart of node (in network) HOT 2
- test: need integration test for node restarts
- Bug: Uncaught parser error
- node cannot sync if network has no snapshots HOT 2
- improvement: better error messages for foreign key errors HOT 2
- improvement: Use `common.BlockContext` within `common.TransactionData`
- core: remove PayloadTypeCallAction HOT 1
- Improve IF semantics
- Disallow actions and procedures to be named function names
- remove the single transaction restriction from pg.DB
- Add `--genesis` flag to `kwil-admin setup init`
- peer filtering and private network support
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from kwil-db.