aido / app-seed-tool

A Ledger application that provides some useful seed management utilities
Apache License 2.0
42 stars 2 forks source link

v1.3.2 Check SSKR recovery phrase "Restart from word #" is broken #9

Closed InfiniteQE closed 10 months ago

InfiniteQE commented 1 year ago

I also found 3 bugs, testing a SSKR recovery on NanoS (restored with the mnemonic below)

I compiled seedtool-cli, then $ seedtool --in bip39 all all all all all all all all all all all all --out hex `$ seedtool --in hex --out sskr --group 2-of-3 0660cc198330660cc198330660cc1983

tuna acid epic gyro fair chef able acid able very flap jazz fizz judo omit dull drop inch body join zinc luck crux pool puff jugs cola meow yoga

tuna acid epic gyro fair chef able acid acid ugly what flux days very urge memo news fact jowl hope luck jump urge beta veto gush days judo each

tuna acid epic gyro fair chef able acid also mild exit easy luck gala hawk girl gush ugly wave axis cost jade slot yank bulb zero knob next liar

1st attempt : Entering a 2of3 scheme, I think I missed a word, so I went to "Restart from word #20", however the word entry counter didn't decrease to the restart word#.

Selecting the "Restart from word # 1" resulted in app SSKR Check freezing.

2nd attempt : I made a selection mistake on word #28, missed the restart, and ended up in word #29 entry. Scrolling right from the confirm byteword entry in #29, it only lets me restart from #24 and below, I can't restart from #28. Selecting restart from #24 the app still says "Enter Share#1 Word#29".

Entering here my 24th word here results in SSKR Check moving on to "Enter Share#2 Word#1"

Issues :

InfiniteQE commented 1 year ago

I've deleted v1.3.2 with ledgerblue, and installed my debian VM built v1.4.0 (from cloning the latest github repo)

aido commented 1 year ago

Hi @InfiniteQE,

I agree that the app SSKR Check needs a bit more 'polish' when dealing with situations where users enter incorrect phrases. Most of the testing to date was to ensure that when a user enters correct input the app generates valid SSKR byte words. This is critical so that users do not lose funds. The functionality and tests for when a user enters incorrect phrases is a bit clunky at the moment but should still be usable.

My defensive logic is that if a user is being serious about protecting their funds they will then take the time to make sure they are typing the correct phrases. :-)

Also, adding extra functionality could be tricky as the size of the app is almost at the limit of a Nano S.