search

leather-io / extension

Leather browser extension
https://leather.io
MIT License
287 stars 135 forks source link

Protect users from sending tokens to exchanges without memos when required #3047

Open 314159265359879 opened 1 year ago

314159265359879 commented 1 year ago

One of the most seen issues on our socials is users sending STX with their non-custodial wallet or from an exchange and forgetting the memo needed for the exchange to credit the correct account.

Hero Gamer suggested we make the memo mandatory when sending to such addresses, to help our users.

Instead we could do a check against probable inbound Decentralized Exchange (DEX) addresses such as the list that can be obtained from stacksonchain.com https://stacksonchain.com/dashboards/Centralized%20Exchanges%20(CEX)%20%40%20Babo/177 image

I think it would be enough to have "probable suspicion" to demand the memo and I do not think we have to specify which exchange is using which address exactly. I think being that specific could be dangerous because exchanges can rotate addresses and even use multiple. A message like this would work very generally I think:

We detected an address that is likely owned by a Centralized Exchange, a memo is mandatory.

Original request/context: https://discord.com/channels/621759717756370964/745197302255321108/1070358737820319814

badonyx commented 1 year ago

Neat idea, although I don't think it should be mandatory but rather some big annoying warning or series of warnings would make sense.

Just to let you know, the dashboard already has a list of known addresses in the query for the CEX Reserves chart. Do be aware that these were all determined heuristically and probably should get some verification from crowd-sourcing or the exchanges themselves where possible. 

with cex (name,accounts) as (
VALUES ('Kraken',ARRAY['SP111MNWTSXGTD0ESMV59WX4KHQA93RTV9F82EK0K'])
, ('Coinbase',ARRAY['SP1FNEJ21BMJCJYEJM2F73QT6WD2MN9MB2J92FZBN','SP1PJWKS5V3X7JR300J3W291DDNCKD6M6XKJFYPAC'
    ,'SPC3T2E3MXHA15Q1TRQJDH57QX6X1D5D7Y9XTXXJ','SPFPBQ30DZ2G4CX8XZGZXD013N2NPHH7K7SB7GEZ'])
, ('Binance',ARRAY['SP1P72Z3704VMT3DMHPP2CB8TGQWGDBHD3RPR9GZS','SP3WV3VC6GM1WF215SDHP0MESQ3BNXHB1N6TPB70S'])
, ('Kucoin',ARRAY['SPX8T06E8FJQ33CX8YVR9CC6D9DSTF6JE0Y8R7DS','SP1V21EG2APTB57VXEM9BK4TFWK1GN8NYW5DB0Q46'
    ,'SP307BHDXSX759Z2XFAM405REWVFJK05HKG7BWRQB'])
, ('Gate.io',ARRAY['SP33XEHK2SXXH625VG6W6665WBBPX1ENQVKNEYCYY'])
, ('Crypto.com',ARRAY['SP1RWW86QN0KKZYZAZ5K4NJX4BQQCVWVSR7CXW5XA','SP243V4D843MNKX5WB46A0PDWH4H5SAQBBHGJN0CH'])
, ('Okcoin',ARRAY['SP3HXJJMJQ06GNAZ8XWDN1QM48JEDC6PP6W3YZPZJ','SP3KANBW2C4E5BRPWNTWZCCDGF2F87CW9D9KV0FFK'])
, ('OKX',ARRAY['SP3RFAZMSH6YA1KTJD7DN997AG2DG54E3Z9ZJWYN8'])
, ('Upbit',ARRAY['SP3G2DMG5WWCP8XF1QZSEQ1XE73X639ABZC835EZV','SPNBYP1MY456K29804XHT4PY5QKMSXNRBHGADTDY'])
, ('BtcTurk',ARRAY['SPXJJ6XPRV52JREBENWFX7TG1CFPFP0QS81BDH0A'])
, ('CoinEx',ARRAY['SP2VK9TBG8E20A0YW228PC70GBMSBFHE7BNVMKB57'])
, ('Unknown 1',ARRAY['SM468VETKA5DB15HWG2QM7Y04EFQKV44R9D6D0QC'])
)

Also should be pointed out that the dashboard currently only considers direct STX transfers and not send-many or send-many-memo contract calls, which I saw recently that some exchanges are using even for individual transfers.

markmhendrickson commented 1 year ago

@0xbabo I'm curious to hear what you think about where we've landed here so far with the implementation re: https://github.com/hirosystems/stacks-wallet-web/pull/3061#issuecomment-1426180364

alter-eggo commented 1 year ago

@mica000 could you help with the design please? design of sending form changed, so our work became irrelevant here: https://github.com/hirosystems/stacks-wallet-web/pull/3061