@horsefacts.eth

Will answer your specific questions first, then share some more on safety. These are gonna be long so will reply separately for each. WALLET ACCESS > If we can grant wallet access to mini apps easily in Farcaster, why can’t we revoke them just as easily? "Wallet access" is an overloaded term. If you're using a mini app, what can it actually do with your wallet? 1. Read token balances. Farcaster is a public social network and your token balances are all public onchain. So really anyone has this capability. But when you use a mini app it does know about your wallet address and the tokens in it, as well as your Farcaster identity. 2. Make requests to do things. Mini apps can ask your wallet to send a transaction or sign a message, but you the human user must always approve or reject them. That doesn't mean they can't try to trick you! But you are always in the loop. So how can you tell if a request is legit? The first screenshot here is Tortoise by @mattlee requesting a transaction to mint a song. When a mini app requests a transaction we scan it with blockaid.io and show you what it will do. In this case I'm sending $4.24 of ETH and getting back an NFT. We also show the domain (tortoise dot studio) and the mini app context (you can see this is Tortoise and it was created by Matt) You can also tap into "Advanced" and see more technical information about exactly what it's doing. (See the second screenshot). This is very useful if you're suspicious of a particular request but not that readable to a normal human. If the request is flagged as malicious we block it. If it's flagged as suspicious we show a warning. We do our best here, but transaction scanning is never perfect: there are always both false positives and false negatives. (In fact, I think we get much more grief from developers for false positives than anything else). 3. Request token approvals. This is really a special case of #2 but since it's so common and can be more dangerous it deserves its own category. One kind of request a mini app can make is asking you to give it an "approval" to spend some amount of a token. This can be a limited or unlimited amount. This pattern is deeply baked into crypto and very much an original sin of crypto UX. The third screenshot here is Crowdfund asking me to approve spending 5 USDC as a donation. If you see an app ask for an unlimited approval here, that's usually a red flag. Of all the things a mini app can do, you should be most careful about approving requests for token approvals. It's the only thing that allows an app to "do something" with the money in your wallet when you're not physically there. But there are many legitimate use cases for approvals. For example, approvals are what enable Tipn and Noice to send tips on your behalf. There's nothing to "disconnect" or "revoke" for 1 and 2. For 3, you can check and revoke approvals with other mini apps (will share one below). Viewing/revoking approvals is something we can and should build in to the app/wallet and I think we will soon.

3 replies

3 recasts

17 reactions