Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inform user of asset permission related risks in credit offer acceptance screen? #3576

Closed
grctest opened this issue Oct 11, 2022 · 0 comments · Fixed by #3603
Closed

Inform user of asset permission related risks in credit offer acceptance screen? #3576

grctest opened this issue Oct 11, 2022 · 0 comments · Fixed by #3603

Comments

@grctest
Copy link
Contributor

grctest commented Oct 11, 2022

Is your feature request related to a problem? Please describe.
If an user borrows an asset which has the ISSUER MAY TRANSFER ASSET BACK TO HIMSELF permissions/flags enabled, then there is a possibility that after borrowing the asset that the funds are transferred back, followed by the user potentially losing the collateral if they fail to reclaim the tokens.

This could perhaps be because the borrowed funds were stolen by the lender, or perhaps by a malicious asset creator.

Describe the solution you'd like
Currently there's no link to the asset the user is about to borrow, only the description in a popup modal.

The simplest solution would be to include a link to the asset being borrowed, perhaps within the modal, then the user can make their own mind up about the risks associated with entering the credit offer deal.

More intrusive could be directly including warnings in the borrow confirmation modal when this permission/flag is enabled.

Describe alternatives you've considered
Write blog posts educating users on risks of social engineering.

Reporting accounts of malicious credit offers for on-chain committee blocklist.

Warn users if the lender is on the on-chain blocklist, or filter their entries from the credit offer page.

Additional context
The ability to transfer asset back to ones self is legitimate, it's an integral part of running an EBA for security, and it can prevent lent assets being burned in exchange for the collateral (if entirely on-chain). Just the presence of this flag/permission isn't enough to condemn, however it does indicate theoretical risk to a borrower.

ihorml added a commit to ihorml/bitshares-ui that referenced this issue Nov 30, 2022
ihorml added a commit to ihorml/bitshares-ui that referenced this issue Jan 23, 2023
ihorml added a commit to ihorml/bitshares-ui that referenced this issue Jan 23, 2023
sschiessl-bcp pushed a commit that referenced this issue Feb 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant