search

ACINQ / phoenix

Phoenix is a self-custodial Bitcoin wallet using Lightning to send/receive payments.
https://phoenix.acinq.co
Apache License 2.0
654 stars 97 forks source link

Potential faulty RNG being used for Phoenix seed generation. #558

Closed ascisco closed 5 months ago

ascisco commented 5 months ago

I have a very very very rare situation that just came to my attention.

I started using phoenix wallet earlier this year, downloading the app and recording the seed phrase. I sent a small amount of bitcoin to fund the wallet and since have only used it once to make a small payment. Out of curiosity, the other day I decided to load my phoenix seed phrase into sparrow wallet. To my utter surprise the wallet populated with a balance of ~0.5BTC and a list of send and receive transactions dating back to March 2023, long before I even had this seed. None of the transactions in this wallet are mine. I double and triple checked the seed and it is 100% the same seed the Phoenix wallet generated for me. The seed was generated on a unmodified Samsung A54, with Phoenix downloaded from the playstore.

The only possible conclusions I can think of is bad entropy or somehow I hit the galactic lottery. The odd thing is that if it is bad entropy, why haven't the funds be stolen yet? Could it be that the implausible chance of 1 out of 2^160 happened and Phoenix generated me a seed that someone else has?

I am not going to steal this person's funds. However I would like to warn them somehow that their seed phrase is at risk. If anyone has a good idea, please share.

pm47 commented 5 months ago

Hello, please send your app logs (Settings > Logs > Share logs) to phoenix@acinq.co.