search

mycelium-com / wallet-android

Mycelium Bitcoin Wallet for Android
http://mycelium.com
Other
660 stars 320 forks source link

Send from single account legacy address (P2PKH) to SegWit bech32 address (P2WPKH) moves change to an inaccessible bech32 address #508

Closed gama20 closed 5 years ago

gama20 commented 5 years ago

Using an imported single-account legacy (P2KPH) address to send to a Segwit bech32 (P2KPH) address.

Normally in single accounts when sending to another P2KPH address, the change goes back to the sending address. This is ill-privacy behavior and have been discussed elsewhere.

However, in the case of sending to P2KPH address the change goes 'back to the account' - but to a newly created P2KPH address, auto-generated on the basis of the account's address private key. This change address is not seen anywhere in the wallet, and consequently the balance reduction from the account is the whole spent output and not the actual spent amount.

I know that SAs are deprecated, but the results can be severe from a user's perspective (E.g: sent less than 0.005 BTC but 2.8 BTC were "shaved" from the account's balance).

agneslovelace commented 5 years ago

hello. thank you for reporting. what version of the app are you using?

gama20 commented 5 years ago

Found it; I had a scratch note somewhere - so issue detected on Mycelium wallet version 2.12.0.26 (2120026)

agneslovelace commented 5 years ago

issue detected on Mycelium wallet version 2.12.0.26

It is known bug for .26. It was fixed in .29. You should see all your balance now, not "shaved", in .29, correct?

gama20 commented 5 years ago

Before reporting I used Electrum wallet import feature using the private key and was able to generate the same P2KPH address and later to sweep the balance from it - so I already have the .29 version but there's nothing in that address to see now.

So in .29 in similar situation the SA account would hold the single derived bech32 address (in the background - without the user being able to see it) and can later spend from it?

agneslovelace commented 5 years ago

Almost. As it says in the changelog: "Bugfix: SegWit addresses generated for pre 2013 standard uncompressed single key accounts were removed, while keeping funds on those addresses spendable." So it is true only for SA with legacy privkeys, i.e. that starts with '5', which are used to derive uncompressed pubkeys.

gama20 commented 5 years ago

For the sake of clarity: with legacy private keys accounts, the change amount is returned to the sending address also when sending to a SegWit address.