Signing permit with Metamask - warning metamask message

[RegisGraptin]

Hello,

I need to sign a permit to request some data from Secret Network. I am using from the SecretNetworkClient the utils.accessControl.permit.sign() function. It works fine, but I have a warning message which could lead to misinterpretation of the request, as you can see:

I would be interest to know if you have workarounds to avoid this kind of message, as users could think it is a malicious transaction which is not the case.

Thanks in advance

[assafmo]

Sorry, there's really no way around this. You're basically asking the user to sign something in a format MetaMask doesn't know, so it shows this warning.

What you can do is prepare the user for this before you make MetaMask prompt for the signature, and also maybe find a way to let the user verify that the hash that they're singing on can be derived from the data.

[RegisGraptin]

Thanks for your answer.

Alright, yeah it seems that, from my understanding, the eth_sign can be problematic as the signed object can be use for anything. So, this is why in the personal_sign from metamask is used to show the user the content and also preprend the message by \x19Ethereum Signed Message:\n<length of message> to address this issue.

It seems that I am kind of stuck here ^^
I wanted to sign a permit and in my smart contract to check if it is the real user, but I will maybe have to do it manually by verifying the user signature from the message. Do you know if secret network as a similar mechanism that handle those kind of message (the one prepend by Ethereum...) ?

[assafmo]

If your contract is not yet deployed then you can implement personal_sign into the permit verification code. I believe the Shade team have already done this, I'll ask them to comment here.

[AustinWoetzel]

for shade we use the secret.js function for MetaMaskWallet -> .signAmino(YOUR_ADDRESS, signDoc: StdSignDoc)

[assafmo]

@AustinWoetzel can you share the code that you've written to handle the verification on the contract side?

[AustinWoetzel]

securesecrets/query-authentication#10

[RegisGraptin]

Wow, this is exactly what I was looking for ! Thank you very much !
Really appreciate your help @AustinWoetzel & @assafmo 🙏