search

langerhans / dogecoin-wallet-new

Dogecoin Wallet app for your Android device. Standalone Dogecoin node, no centralized backend required. Forked from the popular Bitcoin Wallet.
189 stars 105 forks source link

Swept address is not included in wallet backup #73

Open SikoSoft opened 3 years ago

SikoSoft commented 3 years ago

I swept 10k from a paper wallet. The transaction has since been confirmed (as amazing as that is), and the 9999k can be seen on the other address it generated in the app to move the funds too.

However, the wallet backup the app generates DOES NOT contain this address.

I extracted the key pairs, using the tool here (since this app doesn't allow you to do it):

https://www.reddit.com/r/dogecoin/comments/7qh53r/tool_to_recover_dogecoin_private_keys_from_the/

The walletgenerator portion of the process won't work since that tool was found to have a malicious exploit. Instead, I loaded up an offline version of bitcoinpaperwalletgenerator, switched to Dogecoin, then used the tool to validate the private keys wallet-decrypt gave me.

This gave me the usuable format of the public addresses and private keys, but to me astonishment, the address to which this application swept funds to is not included in the wallet backup.

langerhans commented 3 years ago

But the other addresses the wallet used are in the output of the page you linked? I really don't see why that would happen 🤔

SikoSoft commented 3 years ago

Yes, I can confirm this with certainty.

The same thing happens in the rubbish Bitcoin Cash Wallet application, which was also forked off of the same Bitcoin Wallet this Dogecoin wallet was forked from.

It's almost certainly reproduceable whenever a transaction (incoming or outgoing) is not recognized as confirmed by the app. I just experienced this again with the BCH wallet where funds it received were still marked gray after 2 days (despite having many many confirmations in the chain). The wallet backup I made failed to include the addresses.

This is exactly what happened with this Dogecoin wallet. I swept funds and sent them to another address on an exchange. But the app had not finished syncing with the network (even though it allowed me to sweep them). It showed up as confirmed on the blockchain, but the backups I made were not including them.

After many many days the funds eventually showed up into my phone wallet, although the keys are not being included in the backups the app generates.

The codebase from which this was forked is clearly bugged in this regard as I just witnessed it with another coin forked from the same code.

I would argue a major disclaimer should be added saying "by the way, backing up might not actually save all your addresses".

In this state these legacy wallets are in today, they just are not even safe enough for regular use. They're literal money eaters.