search

hashgraph / hedera-services

Crypto, token, consensus, file, and smart contract services for the Hedera public ledger
Apache License 2.0
297 stars 132 forks source link

Prohibit known public keys from being used in some environments #3624

Open rbair23 opened 2 years ago

rbair23 commented 2 years ago

Problem

The hedera-local-node generates a handful of accounts with well known public/private keys that are to be used for documentation / local testing purposes. An unsophisticated user/developer may use these well known keys to create accounts on mainnet, leaving themselves vulnerable to theft by anybody who discovers them.

Solution

We should have a flag in the system to restrict well known keys from being used, and enable that flag at least on mainnet, and probably also on testnet, and maybe even on previewnet. These well known keys are those used by Ethereum devs and those used in hedera-local-node.

Alternatives

No response

lbaird commented 2 years ago

I agree. There’s no harm in doing this, and it will help save some people from making mistakes.

On Thu, Jun 30, 2022 at 10:41 AM Richard Bair @.***> wrote:

Problem

The hedera-local-node generates a handful of accounts with well known public/private keys that are to be used for documentation / local testing purposes. An unsophisticated user/developer may use these well known keys to create accounts on mainnet, leaving themselves vulnerable to theft by anybody who discovers them. Solution

We should have a flag in the system to restrict well known keys from being used, and enable that flag at least on mainnet, and probably also on testnet, and maybe even on previewnet. These well known keys are those used by Ethereum devs and those used in hedera-local-node. Alternatives

No response

— Reply to this email directly, view it on GitHub https://github.com/hashgraph/hedera-services/issues/3624, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABDBYW7MC62LKUZWA4M63RLVRW5YXANCNFSM52JZ5OPA . You are receiving this because you are subscribed to this thread.Message ID: @.***>

mmalik-al commented 10 months ago

Hello @rbair23 Do you have any details on how you would like it to be handled? It sounds like we should reject any transaction (if flag is enabled) that is related to one of those keys https://github.com/hashgraph/hedera-services/blob/develop/hedera-node/data/onboard/evm-addresses-blocklist.csv This issue seems simple but If you dig deepr into it you start to have even more questions, like what about sending something to those addreses? Such a transfer should be blocked too?

Are you able to give more details about keys from being used just to be sure that we are on the same page