[BUG] ICRC-1 Token image not show correctly

[baolongt]

Describe the bug
Some ICRC-1 token cannot show its image even the URL image included in token metadata

To Reproduce
Steps to reproduce the behavior:

1. Go to import token
2. Input 6zn6a-cyaaa-aaaai-q3m3q-cai

Expected behavior
Oisy should get the image from icrc1:logo

record {
      "icrc1:logo";
      variant { Text = "https://ebxi4-aiaaa-aaaai-qpenq-cai.raw.icp0.io/d3?file_id=17GBX9TGRCY0D4BQZYCX7ZTW1P" };
    };

Screenshots

[StefanBerger-DFINITY]

Hi @baolongt
Thanks for letting us know (and the excellent info you have provided!!), and yes, if the image is provided in the metadata of the canister, we should display it.

I will assign it to the dev team and see that we have it fixed asap.

[peterpeterparker]

@StefanBerger-DFINITY please do not rush. I think it's worth double-checking first because I'm not sure a URL is an acceptable value for a logo of an ICRC ledger, especially if it points to a raw URL that uses in addition a query param.

[baolongt]

@StefanBerger-DFINITY please do not rush. I think it's worth double-checking first because I'm not sure a URL is an acceptable value for a logo of an ICRC ledger, especially if it points to a raw URL that uses in addition a query param.

https://github.com/dfinity/ICRC-1/tree/main/standards/ICRC-1#standard-metadata-entries
I think it can be URL, the example only included base64 string

[StefanBerger-DFINITY]

I also just checked the spec, and yes, it says URLs and data URLs are ok.
I will quickly verify with our security team. Will let you know as soon as I have a response.

[peterpeterparker]

The URL of the token logo. The value can contain the actual image if it's a Data URL.

The spec can also be interpreted as only accepting Data URLs, depends the interpretation I guess.

There is currently no ledger that uses an insecure URL to provide a logo to my knowledge. Thanks for double checking!

[StefanBerger-DFINITY]

Hi @baolongt
I checked with our security team, and they also recommended to not look up images via URL, mostly because this exposes a user. Plus, loading from raw URLs is insecure because responses can be manipulated by malicious nodes.
(An internal check also showed that no IC dapp currently load icrc-1 logos when a URL is provided.)

There might be a mid-term solution where we cache token information in a dedicated 'token metadata' canister that allows dapps to access images and such in a secure manner. But that will not happen very soon.

But for now, the fastest way for you to ensure the logo appears on all dapps is to provide it with a Data URL in the metadata.
(If you want some help with that, I can ask our design team if they can help reducing the file size and encode it into a reasonable data URL.)

Best
Stefan

[baolongt]

Hi @baolongt I checked with our security team, and they also recommended to not look up images via URL, mostly because this exposes a user. Plus, loading from raw URLs is insecure because responses can be manipulated by malicious nodes. (An internal check also showed that no IC dapp currently load icrc-1 logos when a URL is provided.)

There might be a mid-term solution where we cache token information in a dedicated 'token metadata' canister that allows dapps to access images and such in a secure manner. But that will not happen very soon.

But for now, the fastest way for you to ensure the logo appears on all dapps is to provide it with a Data URL in the metadata. (If you want some help with that, I can ask our design team if they can help reducing the file size and encode it into a reasonable data URL.)

Best Stefan

Thanks for clear that. I will made an update for the ledger

Also I open an issue for ICRC-1 for making this clear
dfinity/ICRC-1#198