MXCzkEVM / datadash-wallet

Other
0 stars 1 forks source link

Able to Add Public Key as Private Key in Import Account #228

Open reasje opened 4 weeks ago

reasje commented 4 weeks ago

Steps to Reproduce:

Navigate to the account import screen. Enter a public key in the private key field. Complete the import process. Expected Result: The system should validate the input and reject public keys entered as private keys, ensuring that only valid private keys are accepted.

Actual Result: The system accepts the public key as a private key, leading to potential security issues and incorrect account imports.

Impact: This bug allows the import of accounts with incorrect keys, causing confusion and possible security vulnerabilities

Test data: It imports account 4 with account 2's public key, and the keys for both accounts are different

Image

Ac 4: 0xcbf8aed680ce5a3990f948dff2669246cf234b0d

Ac 2: 0x415eb794c10742a7076c3f47eff109c388d312fb