How "What You See Is What You Sign" works?
In cryptography, What You See Is What You Sign (WYSIWYS) is a property of digital signature systems that ensures the semantic content of signed messages can not be changed, either by accident or intent.— Wikipedia
For those who have used hardware wallets (such as Ledger), you will find that the transaction information needs to be confirmed not only in the software, but also in the hardware. The process of confirming transaction information on the hardware is actually "what you see is what you sign".
Why WYSIWYS is Important?
For crypto assets, the private key is undoubtedly the most important. If it is lost, it means you no longer have the ownership of the assets. However, to ensure the security of your assets, it is also important to make sure that the transaction process is under secure conditions. If the transfer address is tampered with by a hacker, then the assets would fall into the hands of someone who is not expected. For software wallets, this is a security risk that has not received enough attention. Suppose your phone or computer is hacked and you see address A on the software interface when you transfer money, but behind it is actually address B. If you confirm the transaction, you are transferring the assets to address B.
For hardware wallets, the code used to parse transactions is difficult to tamper with by hackers due to the use of security elements, which ensures that the transaction information you see is what you transmit to it, making it "what you see is what you sign". If the information displayed on the hardware screen does not match the software, then it is likely that your software has been hacked, the information displayed on the hardware screen is more credible.
WYSIWYS on Jade Wallet
Jade Wallet will ask the user to confirm the transaction information when initiating a transaction. Before using Multi-Party Computation (MPC) to sign it, the user will be asked to confirm the transaction information again, and the information displayed at this time is parsed by the App from the constructed transaction body. This process happens locally in the App to enable "what you see is what you sign".
For readers who know well about security, they may disagree that, as mentioned earlier, if the software is hacked, then the “what you see“ may still be fake. Yes, at the software level, Jade Wallet can also be hacked and the transaction information can be altered. However, MPC makes this attack more difficult and costly, as the hacker needs to hack into multiple users' phones and have multiple signers see the fake transaction information in order for the attack to succeed.
DeFi with WYSIWYS
Jade Wallet not only does "what you see is what you sign" for general transfer transactions, but also applies this feature to DeFi-type smart contract transactions. In the above figure, we can see that for a "Swap" operation on Uniswap, Jade Wallet displays specific and user-friendly transaction information instead of raw data. Other mainstream wallets, including hardware wallets, currently only display raw data in hexadecimal, and some don't even display raw data.
We believe that WYSIWYS is very important to DeFi, and without readable transaction information for signers to review, if raw data is tampered with, it could cause significant irreversible lost.
For this reason, Jade Wallet has customized the transaction parsing function for popular DeFi Dapps, so that when a transaction is confirmed, the contract information called in the transaction body is parsed locally and converted into the corresponding DeFi’s operation content to prevent users from confirming the transaction without any basis.