search

LedgerHQ / ledger-live-desktop

⛔️ DEPRECATED - Ledger Live (Desktop)
https://www.ledger.com/live
MIT License
954 stars 301 forks source link

Accounts on different EVM chains should not re-use the same address #4120

Open dvcrn opened 3 years ago

dvcrn commented 3 years ago

Ledger Live Version and Operating System

Ledger Live 2.32.2

Expected behavior

Each account displayed in Ledger Live should be unique

Actual behavior

Addresses are being re-used

Steps to reproduce the behavior

When creating accounts across different EVM-compliant chains such as BSC and ETH, Ledger Live uses the same deviation path to find the next free account. This results in accounts that are already in-use on ETH for example, to be re-used for BSC.

eg. 0x123 is the first ETH account added, and 0x345 is the second ETH account added.

When creating a new account on BSC, Ledger Live uses the first free address without balance on that chain, which is again 0x123.

Without being aware of this, the user re-uses the same addresses across different chains and compromises his privacy.

Instead, Ledger Live should either use a different deviation path for different chains, use the next free address across all supported chains, or mark accounts that exist on multiple chains as 'multi-chain accounts.

oritwoen commented 3 years ago

The networks you mention, including BSCs, are treated as 2-layer. You can transfer any funds and tokens between them.

Most of the bridges, such as: https://www.binance.org/en/bridge or https://wallet.matic.network/bridge, are based on transferring the same funds to the same address from one network to another.

Likewise, the compatibility of most applications is designed to function this way. And some even download data from multiple networks on the same address.

What you propose would be very burdensome for users and incompatible with most platforms. Among others, it would not be easy to transfer funds from the ETH network to tier 2 networks such as BSC by means of bridging.

dvcrn commented 3 years ago

I wouldn't consider BSC as l2, but I get your point.

It would be much more important to make this visually clear, for example with marking addresses as multi-chain addresses when they are used in accounts across chains. Currently, Ledger displays them completely distinct as separate entities, when they are in reality not. It's also hard to find the next unused address across chains because Live doesn't allow you to add a new address when the previous one doesn't have funds on it yet.

I think the experience here could definitely be improved and made less confusing