user2537: When asking the user to sign a transaction, Nami Wallet displays a screen with a summary showing how the user wallet gets affected (e.g. how much Ada is payed or received).
To be able to compute this summary, Nami must have a complete list of the wallet's own funds (UTxOs). Otherwise, it could be that it does not recognise own input UTxOs consumed in the transaction (input UTxOs being only referred to by the hash of the originating transaction and index).
Now, is it possible that a dApp makes a timing attack where it uses —as input of a transaction— some fresh UTxOs, payed to the users address, that the wallet, however, has not indexed yet ? A user signing the transaction would have the wrong impression that he is not spending own funds, whereas in reality the transaction could spend and transfer to a random receiver the users funds.
The only way to protect against these attacks, I see, is that the wallet needs to query the blockchain for all transaction inputs that it has not indexed, before showing the summary screen. Is this done ? I doubt it, as the screen seems to appear very quickly.
(I use Nami as an example, but this scenario could apply to any wallet.)

user871: DApps merely prepare the transaction and invoke the wallet to get it signed and submitted to the blockchain. So I think the wallets would/should validate if the inputs of the transaction submitted by the dApp, contains just utxos indexed by the wallet and only then show the pop up asking user to sign it.
The scenario would be similar to trying to send more than what a wallet contains (even without a dApp).

2537: <p>When asking the user to sign a transaction, Nami Wallet displays a screen with a summary showing how the user wallet gets affected (e.g. how much Ada is payed or received).</p>
<p>To be able to compute this summary, Nami must have a complete list of the wallet's own funds (UTxOs). Otherwise, it could be that it does not recognise own input UTxOs consumed in the transaction (input UTxOs being only referred to by the hash of the originating transaction and index).</p>
<p><strong>Now, is it possible that a dApp makes a timing attack where it uses —as input of a transaction— some fresh UTxOs, payed to the users address, that the wallet, however, has not indexed yet ?</strong> A user signing the transaction would have the wrong impression that he is not spending own funds, whereas in reality the transaction could spend and transfer to a random receiver the users funds.</p>
<p>The only way to protect against these attacks, I see, is that the wallet needs to query the blockchain for all transaction inputs that it has not indexed, before showing the summary screen. Is this done ? I doubt it, as the screen seems to appear very quickly.</p>
<p>(I use Nami as an example, but this scenario could apply to any wallet.)</p>
 871: <p>DApps merely prepare the transaction and invoke the wallet to get it signed and submitted to the blockchain. So I think the wallets would/should validate if the inputs of the transaction submitted by the dApp, contains just utxos indexed by the wallet and only then show the pop up asking user to sign it.
The scenario would be similar to trying to send more than what a wallet contains (even without a dApp).</p>
