Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create / Import Wallet potential issue with new BIP39 pw field #117

Closed
shrnkld opened this issue Apr 12, 2023 · 1 comment · Fixed by #189
Closed

Create / Import Wallet potential issue with new BIP39 pw field #117

shrnkld opened this issue Apr 12, 2023 · 1 comment · Fixed by #189
Assignees

Comments

@shrnkld
Copy link

shrnkld commented Apr 12, 2023

The new BIP39 pw feature could potentially lead to a loss of funds for new, inexperienced wallet users. Here's a simple example flow that could result in loss of funds:

  1. I'm a new user, and never seen the BIP39 pw box before
  2. I enter my MPW unlock wallet pw believing this is what I'm being asked for, making a typo when I enter the pw (no there's currently no validation on the pw field)
  3. a different wallet is created/accessed due to the addition of the new pw
  4. I send funds to this address
  5. later, in a new session, I try accessing my wallet again by typing the same pw, but this time without the typo
  6. a different wallet is created/accessed and I have no way to recover my funds without guessing what the typo was

The new pw field could also do with an explanation of what it is for, and ideally separation of this new advanced wallet feature from simple wallet access.

@JSKitty JSKitty self-assigned this Apr 14, 2023
@3point14159
Copy link

@shrnkld

Interesting issue you raise.

First thing that comes to mind is a obvious way of recognizing the generated account. Maybe a partial of the first address locked into the top navigation bar of MPW.

Another solution is keystore files. Many wallets, like Avalanche, allow to access a wallet via keystore, which would mitigate this issue altogether.

A preemptive caution about typos when using the bip39 password detailing what you've already mentioned. Tis a problem generating a rando wallet and sending your funds to the nether realms.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants