Fixing Ethereum’s Message Signing Chaos

Message signing in Ethereum is a fundamental process that allows users to verify and authenticate transactions, interact with dApps, and perform off-chain operations securely. However, over time, the methods for signing messages have become fragmented, leading to inconsistencies and confusion among developers and users.

Ethereum currently supports multiple methods for signing messages, which complicates the development process and increases the potential for errors. This fragmentation is partly due to the lack of an enforced standard in the early stages of Ethereum's growth.

There are at least six different ways to sign a message on Ethereum. The existence of numerous signing methods often results in compatibility issues across different tools and dApps.

Although, SIWE standard is designed to bring more uniformity to message signing. However, not all projects adhere to this standard, leading to further inconsistency.

For example, Fuel, a smart contract platform, uses older signing methods instead of newer, more secure alternatives. This deviation may stem from cryptographic considerations or simply a lack of awareness about updated standards.

Many Ethereum wallets, like MetaMask, follow the SIWE standard for signing transactions initiated by websites or dApps. This ensures that the signed data is consistent across different wallets. However, it is noted that some platforms bypass this standard, which can result in unsigned or improperly signed transactions. Developers highlight the need for wallets to declare their signing capabilities clearly. This would enable dApps to detect what signing methods are available and adjust their interactions accordingly.

The lack of a unified signing method increases the attack surface, as different signing methods may have varying levels of security. Users interacting with dApps might encounter errors or incompatibilities due to different signing methods, leading to a poor user experience. Developers must account for multiple signing methods, increasing development complexity and potential for bugs.

Developers and projects need better education on signing standards to ensure they adopt the most secure and efficient methods. Moving forward, coordinated efforts between wallet providers, dApp developers, and the broader Ethereum community will be crucial in achieving this goal.

References: Eth multicall Meeting Dec 30, 2024