search

MetaMask / metamask-extension

:globe_with_meridians: :electric_plug: The MetaMask browser extension enables browsing Ethereum blockchain enabled websites
https://metamask.io
Other
11.87k stars 4.85k forks source link

Confirmation window "From" account is inaccurate. #2770

Closed beether closed 6 years ago

beether commented 6 years ago

I installed metamask. I added some accounts to do testing. I deleted those accounts (by importing from seed words). I added more accounts.

I did a transaction -- confirmation window pops up saying it is "From: XYZ". The sendTransaction call very clearly has {from: XYZ} as well. I hit confirm.

Transaction is sent. Transaction is mined.

I do a web.getTransaction(), and see that the "From" actually turned out to be "ABC". The state of the contract confirms this (in this case, owner was indeed ABC and not XYZ).

Your garbage app CONFIRMED it would send from XYZ, but instead sent from ABC. What's the point of a confirmation window if it flat out lies? Why would you ever send using a different variable than the one being displayed? Can I even trust anything else about this, like the "To" and the (non-viewable) data? At every turn something goes wrong with this POS

tmashuang commented 6 years ago

Can you provide the transaction hash, and the first part of the address that is supposed to be 'from' and the actual address that is being displayed?

beether commented 6 years ago

This was using testrpc and I didn't keep any of the information. It also has not yet happened again since I (again) clobbered all my accounts.

tmashuang commented 6 years ago

I will try reproduce with the information at hand. Can you confirm your TestRPC/Ganache version?

beether commented 6 years ago

Ganache CLI v6.0.3 (ganache-core: 2.0.2)

When I saw the TransactionId appear in ganache (which matched the one metamask gave me), I did a .getTransaction() and saw the real "From" field was of a different account (but an account I had in metamask).

beether commented 6 years ago

If it helps, I had about 7 accounts before clobbering them all.

bdresser commented 6 years ago

hey @beether, closing this issue due to inactivity - if you experience something similar again, please feel free to re-open with detailed steps to reproduce