You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Note: The `method` field in the transaction payload contains the SCALE encoded call data specific to the transaction being signed. This typically includes the pallet name, function name and any parameters required for that specific transaction.
88
+
89
+
## polkadot_signMessage
90
+
91
+
This method returns a signature for the provided message payload. It will be signed by the keypair corresponding to the requested signer address.
92
+
93
+
### Parameters
94
+
95
+
1.`Object` - As per Polkadot type `SignerPayloadRaw` containing:
96
+
-`address`: `string` - SS58 encoded address
97
+
-`data`: `string` - The hex-encoded data for this request
98
+
-`type`: `'bytes' | 'payload'` - (optional) Identifies if the message is arbitrary bytes or a transaction payload
99
+
100
+
:::note
101
+
`polkadot_signMessage` can potentially be used to sign arbitrary transactions blindly. To mitigate this security risk:
102
+
103
+
1. Always wrap messages in `<Bytes>message</Bytes>` tags before hex encoding when message `type` is `'bytes'` or not specified
104
+
2. If the type is not `'payload'`, signers MUST verify that messages are properly wrapped
105
+
3. Use `type: 'payload'` only when signing transaction-like data that should be possible to decrypt
106
+
107
+
This convention helps prevent malicious applications from using `polkadot_signMessage` for blind transaction signing while maintaining compatibility with widely-used Polkadot signing implementations.
0 commit comments