Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: lock KeyringController mutex on verifySeedPhrase #5077

Merged
merged 2 commits into from
Dec 17, 2024

Conversation

mikesposito
Copy link
Member

@mikesposito mikesposito commented Dec 17, 2024

Explanation

The KeyringController.verifySeedPhrase method was not included in the mutable methods that lock the controller mutex because it doesn't change the state. Though, if another operation gets somehow overlapped (e.g. a consumer calls addNewAccount), the call to verifySeedPhrase can potentially fail.

To fix this, this PR is moving verifySeedPhrase behind KeyringController's mutex. Since addNewAccount internally calls verifySeedPhrase, and having a lock on both would create a deadlock, the verifySeedPhrase implementation has been moved to an internal method.

References

Changelog

@metamask/keyring-controller

  • FIXED: verifySeedPhrase is now mutually exclusive

Checklist

  • I've updated the test suite for new or updated code as appropriate
  • I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
  • I've highlighted breaking changes using the "BREAKING" category above as appropriate
  • I've prepared draft pull requests for clients and consumer packages to resolve any breaking changes

@mikesposito mikesposito requested a review from a team as a code owner December 17, 2024 13:39
@mikesposito mikesposito marked this pull request as draft December 17, 2024 13:46
@mikesposito mikesposito force-pushed the fix/verify-seed-phrase branch from fe26d3c to 209dbcc Compare December 17, 2024 14:00
@mikesposito mikesposito marked this pull request as ready for review December 17, 2024 14:05
@mikesposito mikesposito enabled auto-merge (squash) December 17, 2024 14:05
* @returns A promise resolving to the seed phrase as Uint8Array.
*/
async #verifySeedPhrase(): Promise<Uint8Array> {
this.#assertControllerMutexIsLocked();
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This forces any caller to fist lock KeyringController mutex (e.g. with #withControllerLock)

@mathieuartu
Copy link
Contributor

@metamaskbot publish-preview

@mikesposito mikesposito merged commit 99cd1a2 into main Dec 17, 2024
120 checks passed
@mikesposito mikesposito deleted the fix/verify-seed-phrase branch December 17, 2024 14:13
Copy link
Contributor

Preview builds have been published. See these instructions for more information about preview builds.

Expand for full list of packages and versions.
{
  "@metamask-previews/accounts-controller": "20.0.2-preview-209dbcc",
  "@metamask-previews/address-book-controller": "6.0.2-preview-209dbcc",
  "@metamask-previews/announcement-controller": "7.0.2-preview-209dbcc",
  "@metamask-previews/approval-controller": "7.1.1-preview-209dbcc",
  "@metamask-previews/assets-controllers": "45.1.2-preview-209dbcc",
  "@metamask-previews/base-controller": "7.0.2-preview-209dbcc",
  "@metamask-previews/build-utils": "3.0.2-preview-209dbcc",
  "@metamask-previews/chain-controller": "0.2.2-preview-209dbcc",
  "@metamask-previews/composable-controller": "10.0.0-preview-209dbcc",
  "@metamask-previews/controller-utils": "11.4.4-preview-209dbcc",
  "@metamask-previews/ens-controller": "15.0.1-preview-209dbcc",
  "@metamask-previews/eth-json-rpc-provider": "4.1.6-preview-209dbcc",
  "@metamask-previews/gas-fee-controller": "22.0.2-preview-209dbcc",
  "@metamask-previews/json-rpc-engine": "10.0.1-preview-209dbcc",
  "@metamask-previews/json-rpc-middleware-stream": "8.0.5-preview-209dbcc",
  "@metamask-previews/keyring-controller": "19.0.2-preview-209dbcc",
  "@metamask-previews/logging-controller": "6.0.3-preview-209dbcc",
  "@metamask-previews/message-manager": "11.0.3-preview-209dbcc",
  "@metamask-previews/multichain": "2.0.0-preview-209dbcc",
  "@metamask-previews/name-controller": "8.0.2-preview-209dbcc",
  "@metamask-previews/network-controller": "22.1.1-preview-209dbcc",
  "@metamask-previews/notification-services-controller": "0.15.0-preview-209dbcc",
  "@metamask-previews/permission-controller": "11.0.4-preview-209dbcc",
  "@metamask-previews/permission-log-controller": "3.0.2-preview-209dbcc",
  "@metamask-previews/phishing-controller": "12.3.1-preview-209dbcc",
  "@metamask-previews/polling-controller": "12.0.2-preview-209dbcc",
  "@metamask-previews/preferences-controller": "15.0.1-preview-209dbcc",
  "@metamask-previews/profile-sync-controller": "3.1.1-preview-209dbcc",
  "@metamask-previews/queued-request-controller": "8.0.2-preview-209dbcc",
  "@metamask-previews/rate-limit-controller": "6.0.2-preview-209dbcc",
  "@metamask-previews/remote-feature-flag-controller": "1.2.0-preview-209dbcc",
  "@metamask-previews/selected-network-controller": "20.0.2-preview-209dbcc",
  "@metamask-previews/signature-controller": "23.1.0-preview-209dbcc",
  "@metamask-previews/transaction-controller": "42.0.0-preview-209dbcc",
  "@metamask-previews/user-operation-controller": "21.0.0-preview-209dbcc"
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants