[Bug]: ethers signTypedData returns incorrect signature / recovered address

[cieltan]

Describe the bug

Over the last week, when using the ethers signTypedData function on Metamask Mobile, the returned signature does not return the correct signer address when trying to recover it using the ethers verifyTypedData function.

This behavior on Metamask mobile is completely different from the desktop extension. When going through the same flow on desktop, the returned signature is correctly recovered with the correct address when using the verifyTypedData function.

This bug is affecting all users interacting/performing marketplace actions such as listing/delisting with NFT marketplaces based on the Avalanche network that require signing messages.

I'm just trying to get clarity as to how these functions might behave differently on mobile vs desktop. In the E2E metamask dapp, the signTypedData function seems to still work correctly.

Expected behavior

The ethers signTypedData function should returns a signature that can recover the signer on mobile. This function works as expected on desktop with the Metamask extension.

Screenshots/Recordings

No response

Steps to reproduce

1. Go to any NFT marketplace that requires off-chain signing. (i.e. https://avax.hyperspace.xyz/, https://joepegs.com/)
2. Try to list or delist any NFT in your account. The action will either silently fail or outright fail because of reasons stated above.

Error messages or log output

No response

Version

7.10.0

Build type

None

Device

iPhone 13 Pro Max

Operating system

iOS

Additional context

This is an example of how we're structuring the message to be signed. This is recoverable on desktop but not on Metamask Mobile.

const domain = {
      chainId: chainId,
      verifyingContract: exchangeContractAddress,
      name: 'ZeroEx',
      version: '1.0.0',
    };
const types = {
    [ERC721ORDER_STRUCT_NAME]: ERC721ORDER_STRUCT_ABI,
    Fee: FEE_ABI,
    Property: PROPERTY_ABI,
};
const value = order;
    
// signer is a JSONRPCSigner
    
const rawSignature = await signer._signTypedData(
      domain,
      types,
      value
);

Severity

No response

[robpolak-cb]

Can confirm seeing similar issues with https://nft.coinbase.com .. Confirmed that switching wallets solved the issue for us.

[Gudahtt]

Thanks for the report! We're trying to reproduce the issue but haven't had success yet. Could you share an example message that demonstrates the problem?

I see that you provided a partial example already, but quite a few details are missing (e.g. the ABI types and the example value)

[cieltan]

Thanks for the report! We're trying to reproduce the issue but haven't had success yet. Could you share an example message that demonstrates the problem?

I see that you provided a partial example already, but quite a few details are missing (e.g. the ABI types and the example value)

Sure, here is a more expanded version of the snippet above.

export const ERC721ORDER_STRUCT_NAME = 'ERC721Order';

export const ERC721ORDER_STRUCT_ABI = [
  { type: 'uint8', name: 'direction' },
  { type: 'address', name: 'maker' },
  { type: 'address', name: 'taker' },
  { type: 'uint256', name: 'expiry' },
  { type: 'uint256', name: 'nonce' },
  { type: 'address', name: 'erc20Token' },
  { type: 'uint256', name: 'erc20TokenAmount' },
  { type: 'Fee[]', name: 'fees' },
  { type: 'address', name: 'erc721Token' },
  { type: 'uint256', name: 'erc721TokenId' },
  { type: 'Property[]', name: 'erc721TokenProperties' },
];

export const FEE_ABI = [
  { type: 'address', name: 'recipient' },
  { type: 'uint256', name: 'amount' },
  { type: 'bytes', name: 'feeData' },
];

export const PROPERTY_ABI = [
  { type: 'address', name: 'propertyValidator' },
  { type: 'bytes', name: 'propertyData' },
];

const exampleValue = {
    "direction": 0,
    "maker": "0xe17b0e1b433fa922d2db81c054c40a207b0f9bcf",
    "taker": "0x0000000000000000000000000000000000000000",
    "expiry": "2524604400",
    "nonce": "100131415900000000000000000000000000000057349237573513839986502369650552413525",
    "erc20Token": "0xb31f66aa3c1e785363f0875a1b74e27b85fd66c7",
    "erc20TokenAmount": "1000000000000000000",
    "fees": [
        {
            "amount": "20000000000000000",
            "recipient": "0x87f45335268512cc5593d435e61df4d75b07d2a2",
            "feeData": "0x"
        },
        {
            "amount": "5000000000000000",
            "recipient": "0x91c1c72c21bed9d80cc28d926cac60d09dcbaf92",
            "feeData": "0x"
        }
    ],
    "erc721Token": "0x95008965fabbe94c9e6d64389069cc310e6c193e",
    "erc721TokenId": "1433",
    "erc721TokenProperties": []
}

[Gudahtt]

Thanks, that was very helpful! I have been able to reproduce the problem

[DmitryBespalov]

Hey there, just to let you know that the fix above still didn't remove the issue in the most recent MetaMask app. We went with a workaround: using empty string "" instead of "0x" for a data/bytes parameter with the eth_signTypedData_v4.

[cieltan]

Hey there, just to let you know that the fix above still didn't remove the issue in the most recent MetaMask app. We went with a workaround: using empty string "" instead of "0x" for a data/bytes parameter with the eth_signTypedData_v4.

It's unclear if this fix was even included in the 7.12.0 release? @Gudahtt for clarity if this fix is active in the app store version of the Metamask app?

[metamaskbot]

Missing release label release-7.12.5 on issue. Adding release label release-7.12.5 on issue, as issue is linked to PR #7886 which has this release label.

[Gudahtt]

Sorry for the mix-up, this fix will be included in v7.12.5