Enforceable Human-Readable Transactions: how to solve Bybit-like hacks

[PatrickAlphaC]

@MicahZoltu

function validateDslHash(bytes32 hash) {
	if (hash == 0xdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef) return true
	if (hash == 0xcafebabecafebabecafebabecafebabecafebabe) return true
	return false
}

I see. I think I do understand now better what you’re looking for, thank you for explaining! Ok, what you’re saying is a lot closer to making sense than I originally thought. The part I was missing was the fact that the untrusted website gives a DSL with the parameters in the DSL itself, that’s pretty cool. And then the wallet can “read” this DSL.

My issue still persists, though; I think for big, complex transactions, this still breaks down.

@PatrickAlphaC

There are four contracts we have to interact with:

1. Safe
2. Aave
3. USDC
4. Multisend

I’d like to see how your proposal would solve something like this. It seems to me that this would go back to the “terms of service” issue, where the description is too big and people still sign, and they don’t really know what they are signing still. Whereas if a wallet just decodes calldata “better”, that’s more readable, more reliable, and cheaper in the long run.