search

0LNetworkCommunity / libra-framework

9 stars 31 forks source link

Bricked account #175

Open Teisson opened 6 months ago

Teisson commented 6 months ago

Initial bug issue: https://github.com/0LNetworkCommunity/carpe/issues/205

A little more information on the issue: https://0l.fyi/accounts/1C69FC2C5211343850B38790BFAC39F6C821946F926A4AB323BBFD0C96F93D4E https://0l.fyi/accounts/C821946F926A4AB323BBFD0C96F93D4E

IMG_1041 Screenshot_2024-02-14_at_4 48 46_PM IMG_3642

@0xzoz @0o-de-lally

hiup-cli commented 6 months ago

Hey team, do you have any update on the issue? do you need any help with it?

As I understand what happened here:

  1. User has a account on v5 (but you mentioned it's not v5 but libra wallet legacy here discord link), regradless what libra wallet legacy the address is: c821946f926a4ab323bbfd0c96f93d4e
  2. User accesses v6 via recovery in the new app, provides the seed of the OG c821946f926a4ab323bbfd0c96f93d4e, but instead of recovering (because of no assertion proposed in this branch) a brand new account gets created
  3. User transfer funds on the new account, the account gets on chain
  4. User tries to recover wallet with private key with 32 zeros, it does not help

I have couple of questions:

  1. I do not understand how come the https://0l.fyi/accounts/00000000000000000000000000000000C821946F926A4AB323BBFD0C96F93D4E even exist on the v6 chain? was it because of the recovery with private key attempt?
  2. if the zero-prefixed account exists on v6, what seed points to this? we know that it cannot be the old one, because old seed points to 1C69FC2C5211343850B38790BFAC39F6C821946F926A4AB323BBFD0C96F93D4E
  3. is 00000000000000000000000000000000C821946F926A4AB323BBFD0C96F93D4E even a legit address? is it possible that if we rotate the keys of 1C69FC2C5211343850B38790BFAC39F6C821946F926A4AB323BBFD0C96F93D4E we might access 00000000000000000000000000000000C821946F926A4AB323BBFD0C96F93D4E?
  4. Do you have any clues and things to try from engineering perspective? I heard of few similar cases, finding a way to recover legacy accounts might be helpful.