Other nomination

Metamask Snaps: Playing in the Sand

Bruno Halltari and Caue Obici · OtterSec · 1 November 2023

MetaMask Snaps run untrusted extension code behind an isolated iframe, LavaMoat and Secure ECMAScript, with an RPC allow-list deciding which wallet methods a snap may call. The article documents a permission bypass: arguments are validated, then re-serialised by a sanitiser that honours a caller-supplied toJSON method, so the object reaching the wallet differs from the one approved. A snap without the ethereum-provider endowment could thus issue blocked RPC calls.

Record

Researcher

Bruno Halltari and Caue Obici

Published by

OtterSec

Date

1 November 2023

In the archive

• Nominated for the 2023 Top 10 Web Hacking Techniques

Tags

• browser-extension
• javascript
• sandbox-escape
• filter-bypass
• toctou
• privilege-escalation
• owasp-a01-2021
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Bruno Halltari and Caue Obici, first published at the original source. Preserved copies are kept so the citation survives its host.