search

helium / hotspot-app

Helium hotspot app for iOS and Android
https://www.helium.com
Apache License 2.0
187 stars 139 forks source link

Guardrail for Hotspot Transfer #1265

Closed Ryan-Goldstein closed 2 years ago

Ryan-Goldstein commented 2 years ago

Describe the bug I've seen numerous reports of people accidentally transferring their hotspot to another hotspot's address rather than a wallet address, apparently resulting in it becoming permanently inaccessible.

To Reproduce Steps to reproduce the behavior:

  1. Select a hotspot that the wallet owns, and go to Transfer Hotspot.
  2. Confirm the hotspot's name and press Continue Transfer.
  3. Copy a hotspot's b58 address in the BUYER ADDRESS field (rather than a wallet address).
  4. A green checkmark appears, indicating that this is a valid destination address, and the transaction is allowed to proceed.

Expected behavior Some kind of error should appear instructing the user that the address they entered is not a wallet address, and they should not be allowed to proceed with the transaction.

Screenshots https://user-images.githubusercontent.com/8300089/157138872-67639255-d1fb-4e52-86d0-eee198d14cec.jpg

Smartphone (please complete the following information):

Ryan-Goldstein commented 2 years ago

Here's an example of a transaction where someone accidentally transferred his hotspot to another hotspot's address rather than a wallet address: https://explorer.helium.com/txns/hVx0pKhls1xXH-SYNbi_Xq1iD--gpLXwkpiPNEj1mfw

He intended to transfer his hotspot, Calm Maroon Aardvark, to:

13mC5rTagYmdBZwP58YsL6N6rxjCyxwEAmCaBm4Z1ExftS2vQQx

But instead, he inadvertently transferred it to the b58 address of the hotspot owned by that wallet, Perfect Punch Canary:

11wfsq5dLLX9XZYoP51xtYv4jfqGWxeS8GaqzzVJ11MXuBN2o6v

So now, 'Perfect Punch Canary' is also a wallet address that owns Calm Maroon Aardvark, with no means to regain access to the Perfect Punch Canary hotspot.

Ryan-Goldstein commented 2 years ago

When the keyboard is collapsed, the green checkmark goes away, and it says it's an invalid wallet address. This was apparently fixed in v.3.11.0, so I'm closing this issue.