search

MetaMask / metamask-extension

:globe_with_meridians: :electric_plug: The MetaMask browser extension enables browsing Ethereum blockchain enabled websites
https://metamask.io
Other
12.03k stars 4.91k forks source link

Feature: Warn on attempt to send Ether/Tokens to known-insecure accounts on Mainnet #2608

Closed benjamincburns closed 6 years ago

benjamincburns commented 6 years ago

When the Truffle team launched Truffle Develop, we thought it'd be fun to use an extra sweet, chocolatey mnemonic (candy maple cake sugar pudding cream honey rich smooth crumble sweet treat). It showcased well in the docs, made things nice and repeatable, and gave us subliminal warm fuzzy feelings. These were all expected results.

There were, however, some rather unexpected results. You see, 0x627306090abaB3A6e1400e9345bC60c78a8BEf57 is the first account produced by that mnemonic.

Initially I thought "oh, we should be nice people and write a refund bot," but I think that's catching it too late. Instead, it'd be nice if there were a mechanism which warned when users attempted to send Ether/Tokens to known-insecure accounts on Mainnet.

danfinlay commented 6 years ago

The difficult task here is curating a list of known insecure accounts. We could easily implement this with a good curation method.

tcoulter commented 6 years ago

Note: removed a previous suggestion about adding private keys here. Even if we do find a way to curate, we likely don't want to publicly list private keys/mnemonics as it adds further security risks.

deviant32 commented 6 years ago

I just lost 1 Eth to this. I was using the wallet metamask generated for me using the following wallet id: 0x627306090abaB3A6e1400e9345bC60c78a8BEf57 I sent my eth to this account and it transferred .2 to another address using .78 transaction fee.

kapsteur commented 6 years ago

Another case of stolen ETH due to insecure account : https://www.reddit.com/r/ethtrader/comments/7qily1/my_eth_disappeared_from_my_metamask_account/

danfinlay commented 6 years ago

One easy permanent fix for this problem would be for truffle/ganache to not use the same seed phrase for every user of the application. @tcoulter?

bdresser commented 6 years ago

Closing due to inactivity - if this is still relevant, feel free to open a new issue.