The Transaction Verifier uses QR codes to confirm the validity of any transaction carried out on the Flare Portal.
When signing transactions on a website like https://portal.flare.network/, there are three main attack vectors to be aware of:
- A spoofed website with a very similar URL.
- The dapp you are signing the transaction with has been hacked.
- The libraries submitting the transaction to your wallet are hacked.
For the first, there is no substitute for diligence. Only access the Flare Portal from the main Flare website, and very carefully verify there are no strange characters in the url. For the other two risks, there is the Flare Transaction Verifier.
If the dapp you are interacting with has been hacked, it might send an incorrect or malicious transaction to your wallet to sign. If the libraries have been hacked, the dapp will send you the correct transaction, but it will be changed by the library handling the connection before it reaches your wallet. In both cases, the transaction displayed in your wallet won’t match the one shown in the Flare Transaction Verifier app, so it will be clear that you should not proceed. It is also important to check that the displayed details correctly describe the transaction you are expecting.
Instructions for use
- Download and install “Flare Transaction Verifier” on your mobile device. There are iOS and Android versions.
- When you submit a transaction on the Flare Portal (https://portal.flare.network) to your wallet, the Portal will display a window with a QR code.
- Open the “Flare Transaction Verifier” app and scan the QR code.
- It will show the details of the transaction you sent to your wallet. Ensure these details describe the transaction you are expecting and match the data shown in your wallet. If it does not match, do not proceed with the transaction and alert the team immediately.
- In some cases (e.g. staking with Metamask), the wallet will only show a message you are about to sign (which represents a hash of your transaction data). You can click on the “Verify with OCR” button to check if the messages are identical. This will prove that the message you are about to sign is exactly the hash of the data shown in the Flare Transaction Verifier app.
