search

mytonwalletorg / mytonwallet

The most feature-rich web wallet and browser extension for TON Network
https://mytonwallet.io
GNU General Public License v3.0
393 stars 116 forks source link

Cannot Send Domain/NFT from Ledger #73

Open woodydeck opened 6 months ago

woodydeck commented 6 months ago

Ledger functionality was introduced without the ability to sign Tx for contracts. This means all domains are stuck without understanding how to sign at the low level, which is not something end users should have to do.

It should be a top priority to fix this problem. In the event of a security problem users will have no way to send out their assets. This is bad.

mytonwalletorg commented 6 months ago

Unfortunately, managing contracts and sending NFT is not supported by the Ledger TON app itself (the one in Ledger Live), we can not affect that. We do know, there is a new version of that app in development at the moment, but they provide no ETA.

woodydeck commented 6 months ago

It would be wise then to remove Ledger functionality by default. It can be hidden behind an option with a very strong warning.

mytonwalletorg commented 6 months ago

Makes sense, we will consider that.

woodydeck commented 6 months ago

I just double checked in the ton-cli repo, while ledger works just fine, there's no way to construct a raw transaction. I'm sure I could figure this out and write something if I had enough time, but I don't. I will pester them to explain what's happening and hopefully get this sorted.

One of the worst problems now in TON is a lack of hardware wallet support. It's a lot harder to validate contracts compared to EVM chains, so fighting drainers is a top priority for users. In this case a cold wallet with paper is the best way.

Off-topic Feedback While I'm At It:

I mostly use Tonkeeper, it's a great wallet, but it has some questionable UI in terms of security, truncating the addresses too thin, and no HW support. I prefer MyTonWallet's desktop version and UX. It would be great to push security features on desktop. I still don't like using mobile wallets, and distrust centralized APIs communicating things with signed Tx like on Tonkeeper. Really awesome though for your average day to day transactions for small money, not so great for security as it adds a lot of surface.

mytonwalletorg commented 6 months ago

I mostly use Tonkeeper, it's a great wallet, but it has some questionable UI in terms of security, truncating the addresses too thin, and no HW support. I prefer MyTonWallet's desktop version and UX. It would be great to push security features on desktop. I still don't like using mobile wallets, and distrust centralized APIs communicating things with signed Tx like on Tonkeeper. Really awesome though for your average day to day transactions for small money, not so great for security as it adds a lot of surface.

So what exactly are you suggesting to us as MyTonWallet team?

woodydeck commented 6 months ago

I mostly use Tonkeeper, it's a great wallet, but it has some questionable UI in terms of security, truncating the addresses too thin, and no HW support. I prefer MyTonWallet's desktop version and UX. It would be great to push security features on desktop. I still don't like using mobile wallets, and distrust centralized APIs communicating things with signed Tx like on Tonkeeper. Really awesome though for your average day to day transactions for small money, not so great for security as it adds a lot of surface.

So what exactly are you suggesting to us as MyTonWallet team?

For security:

Multi-sig wallets for business and family. Linking and icons for verified source code of contracts direct to Tonscan, maybe with an internal trust score weighted recursively by a trust score and account age. Desktop wallets should be less hot wallet-y.

To solve current issue:

Offline transaction signing. In this case a workaround would be to provide the tools of MyEtherWallet (or whatever the fork of that is called). You create the input, and then the way to sign that input. This can be a way to agnostically allow more HWs.

Most end users use mobile. As a dev I barely touch my phone during the day. I have about 30 minutes screen time a day. Desktop is where business happens, so all things for business should migrate from desktop to mobile imo.

daic11 commented 6 months ago

How can I export a seed phrase from my Ledger to MyTonWallet? Ledger has by default BIP39 passphrase which IS NOT compatible with MyTonWallet. They do their own convert to BIP32.

Please help me to recover my NFTs.

https://github.com/LedgerHQ/app-ton-new/blob/develop/src/common/bip32.c

Here is a link of their conversion function.

mytonwalletorg commented 6 months ago

https://github.com/mytonwalletorg/ton-ledger-export

woodydeck commented 6 months ago

Awesome! Let this be an example for everyone else in the community. Crypto development is hard and comes with the unexpected.

daic11 commented 6 months ago

BEST!!! THANK YOU!!!

GolovkoStepan commented 5 months ago

Please tell me, in which application can I use a private key instead of a passphrase? TrustWallet is suitable, but it cannot transmit nft.

mytonwalletorg commented 5 months ago

Please tell me, in which application can I use a private key instead of a passphrase? TrustWallet is suitable, but it cannot transmit nft.

MyTonWallet

daic11 commented 5 months ago

Please tell me, in which application can I use a private key instead of a passphrase? TrustWallet is suitable, but it cannot transmit nft.

Just use MyTonWallet and paste a private key instead the first word in passphrase window and press enter.