ledgerhq / ledger-asset-dapps

Ledger Asset DApps

This repository is a structured list of DApps descriptors cryptographycally signed by Ledger. Each blockchain has its own directory (currently only Ethereum and some of its L2s are supported, but more will come). Inside an blockchain's directory, every DApp has its own directory as well and contains a file named b2c.json which is summary of the smart contracts and methods that Ledger supports. This file can refer to smart contract ABIs that are available in the abis folder. There is also a *_signature.json file, which is the signature of the DApp descriptor by Ledger. The descriptors are send along with their signature to Ledger devices to verify their authenticity.

This repo can be seen as a way to add a supported dApp to Ledger's products. A product could parse this repository and use it to support new DApps. Currently, it is used by the Ethereum application and its plugins on Ledger Nano S/S+/X, to provide rich display when approving a DApp transaction.

Signature

Signature process

The signature takes into account the content of the b2c.json files and abis folder.

Production signature

Only a quorum of Ledger employees is authorized to create new production signatures.

Test signature

Not yet supported, coming soon.

Contributing

If you want to contribute, please checkout the contributing guide here.

Tips

In case you need to update to lowercase all Ethereum addresses, you should be able to do this with something like

sed -e 's/\("0x.*"\)/\L\1/' b2c.json > b2c.json.new

ledger-asset-dapps's Issues

Defining off-chain EIP-712 messages with no contract

I'd like to be able to sign an off-chain EIP-712 message with Ledger devices. (Currently, Ledger Live immediately rejects signing requests for such a message, without any user interaction. I can sign using a Ledger device connected via MetaMask, but with only the message hash visible though.)

I understand that I need to add a definition to this repo for the EIP-712 message. However the eip712.json files in this repo expect to have a contract address, which the off-chain message I'm dealing with does not have.

This is an example of an EIP -712 message I want to sign:

{
    "domain": {
        "chainId": "1",
        "name": "reddit",
        "salt": "reddit-sIvILoedIcisHANTEmpE",
        "version": "1"
    },
    "message": {
        "address": "0xd2a2b709af3b6d0bba1ccbd1edd65f353aa42c66",
        "expiresAt": "2024-02-16T05:59:21Z",
        "nonce": "afe92dbe85ec240bd4eeb3c68cb2ed35739ada4919d7320e56ed22bfbd154cdb",
        "redditUserName": "Sure-Complaint4987"
    },
    "primaryType": "Challenge",
    "types": {
        "Challenge": [
            {
                "name": "address",
                "type": "address"
            },
            {
                "name": "nonce",
                "type": "string"
            },
            {
                "name": "expiresAt",
                "type": "string"
            },
            {
                "name": "redditUserName",
                "type": "string"
            }
        ],
        "EIP712Domain": [
            {
                "name": "name",
                "type": "string"
            },
            {
                "name": "chainId",
                "type": "uint256"
            },
            {
                "name": "version",
                "type": "string"
            },
            {
                "name": "salt",
                "type": "string"
            }
        ]
    }
}

The domainSeparator hash of this message is 0x7ba5661dd0ce2767a99b4ab20a3ff32713b280c5097ca1311fc475ed993f9a0c.

Would it be possible to allow messages to be defined in this repository using a domainSeparator hash instead of an address, in cases where a message does not specify a verifyingContract in its domain? Perhaps the domain's un-hashed values should be provided in the definition file too for better transparency.

---

Note, this message format is used by Reddit to approve user requests to associate a Wallet address with a Reddit account, to create what they call a Vault. I'm not affiliated with Reddit, I'm just working on an app that handles and needs to sign these messages.

Need to whitelist an Arbitrum contract

I need to whitelist an Arbitrum contract. Looking at the root of this repo I don't see arbitrum folder created, but then I read this post about Arbitrum support on Ledger.

In order to whitelist an Arbitrum contract - should it be added in the ethereum directory?