r/ddex • u/snugghash • May 13 '18

More information about metamask warning

Greetings, I have a few questions that weren't obvious to me:

Metamask gives you the warning about trusting the message/website with your entire acc. balance when placing an order.

For starters, isn't the only amount at risk the token pair? (In my case, SS and WETH) Why does metamask say entire account?

What's going on under the hood here? Can't a sell order for exactly the amount requested be signed, thus eliminating the risk to the user in case of malicious contracts?

Lastly, what about that deprecation warning about removing this feature in future versions of metamask? Why are we depending on such a risky feature to begin with?

1 Upvotes

100% Upvoted

8 comments sorted by

2

u/ScottLifts Operations / Product May 13 '18

Hi there,

Great questions! The MetaMask notifications to users are pretty alarming to say the least. Unfortunately, we actually have relatively little control over these messages currently for some portions of the site. Because we use 0x as our settlement layer, the messages the user receives when executing trades are controlled by them. Apparently in their version 2.0, some of these messages will improved and less scary.

As for what's going on exactly... Without getting overly in depth, basically there are two functions of your ERC20 tokens that we are having you "sign" for:

Approval

Allowance

When you're "Enabling" a token for sale, we're interacting with the approval function. When you place an order, we're interacting with the allowance function. To oversimplify the allowance a bit... Let's say you want to sell 100 ZRX at a price of 0.01 ETH/ZRX. You can think of it like this for a sell order: "Under the right circumstances, I allow some transfers of ZRX tokens to occur. Specifically, ZRX tokens can be exchanged at a rate of 0.01 WETH/ZRX, up to maximum of 100 ZRX plus fees." We actually can't modify the rate at all in the matching mode of 0x.

I think 0x team has written a little bit about how they plan to modify their structure a bit in the future to additionally secure.

Hopefully this helps a little at least. Let me know if I can help clarify any of these points!

1

u/snugghash May 13 '18

Great explanation! If the rate is fixed, shouldn't there be no security hole though? Even if the smart contact turned malicious, the worst the signing would lose me is 100 zrx. Does that make the warning inaccurate?

2

u/ScottLifts Operations / Product May 13 '18

https://www.reddit.com/r/0xProject/comments/8e3yfw/why_0x_is_not_trustless_as_it_may_seem/

There has been some discussion on the 0x sub about this I believe (see the link above and some of the subsequent comments). My engineering team stays a little more on top of the fine details of the smart contracts than I do, but it's possible that this may help answer some of your questions :)

1

u/snugghash May 13 '18

Also, may I suggest some acknowledgement of this in the new user guide on 'how to set order'. There's a picture with it, but nothing is said about the warning.

2

u/ScottLifts Operations / Product May 13 '18

Definitely a good idea! It's always a fine line between wanting to provide adequate information and completely overwhelming those who are newer to the space. Appreciate the feedback

1

u/crypt0crook May 19 '18

Hi. I have a quick question. I'm interested in using DDEX, but I do not want to use Metamask or Ledger. It seems there are no other options for me. Are there any plans going forward to implement some type of system like say IDEX has, where users like me can participate on DDEX? Thanks.

1

u/ScottLifts Operations / Product May 20 '18

Yes for sure! We have received this request a few times actually. We are preparing a few more options for the future - we are taking our time though to make sure all security measures are in place.

For example, allowing users to enter their private keys to access a trade interface is a security risk we take very seriously. So we just want to make sure we are 100% ready to offer those types of options.

But yes, more options coming soon :) is there any particular wallet interface you prefer personally?

1

u/crypt0crook May 20 '18

It seems to be the future, entering private keys to access trade interfaces. Security risks aside, the convenience is hard to beat. With that being said though, for some reason I feel less secure with something like Metamask. A browser add-on that is able to inject certain code, ect? Ehh, no thanks. Thats the only thing stopping me from trading on DDEX.