search

iancoleman / bip39

A web tool for converting BIP39 mnemonic codes
https://iancoleman.io/bip39/
MIT License
3.42k stars 1.42k forks source link

Ethereum. Incomplete private key format generation #469

Closed clouduserops closed 3 years ago

clouduserops commented 3 years ago

Hi, I've been used your BIP39 mnemonic code convertor to generate public and private keys, but noticed that your application not always outputs the correct private key (without two characters at the end). I looked at 200 addresses and found that 3 of them had an incomplete private key. I think this is a serious remark and would like you to fix it, if possible. Flaw

iancoleman commented 3 years ago

Thanks for reporting this.

Are you able to give any details how to reproduce this so I can dig deeper into it?

iancoleman commented 3 years ago

Ok I found one, a bit further in the list than yours at 487, but I can look into it from here

cruel someone more grant obey frown exotic elevator syrup version shock original unusual mansion account
m/44'/60'/0'/0/486,0xDb5262E7c39CB4BAbf038De81841BDbe01Af1B52,0x0291367c586d9507cfded82023a008c1997804da2219fff6e9b4618475d30a12d4,0xfba5f764d4285676df33c61d2b675526542d336a7f651326d061bc7b934425ac
m/44'/60'/0'/0/487,0xa2F91819DfC12814e05344fF3D253E026633ECDF,0x02cf2fcea2cf7d4a2e9f13a849d60a29f25430b26dcc50f8c1cf95506f3a275476,0x259a352f834577284c2b8c048b2fa434611c1fcb8c13dbe7d3264ebe17d04e
m/44'/60'/0'/0/488,0xE92636908845F6EC0cE6f6bAa1F6C95C3Fe449bd,0x02e88a6ce4e07839fe5a9db4ec31fda85b3706e810f3968b16a3f54139bbaee06e,0x9db1f0a72f63553ceb3bb5117d249d9da9be9847c97e3d1a1c85a330b8ffa800
iancoleman commented 3 years ago

It's missing a leading zero byte. Confirmed using rust ethkey library.

0x259a352f834577284c2b8c048b2fa434611c1fcb8c13dbe7d3264ebe17d04e // incorrect
0x00259a352f834577284c2b8c048b2fa434611c1fcb8c13dbe7d3264ebe17d04e // correct

If this is part of an eth library that's where it'll need to be fixed, or if it's in this app I'll fix it here. Let me see.

Main thing is no funds are at risk, and it's easy to fix manually if needed right now before the patch is released (just add the two leading zeros).