search

status-im / status-mobile

a free (libre) open source, mobile OS for Ethereum
https://status.app
Mozilla Public License 2.0
3.9k stars 987 forks source link

Seedphrase with any value outside dictionary always recovers the same account #9307

Closed Serhy closed 4 years ago

Serhy commented 5 years ago

Bug Report

Problem

If any of seed phase values outside of Status dictionary we still give ability to proceed with recovering flow notifying user that "One or more words might be misspelled". However, in that case there is always the same address and public key is recovered: 0x959FD7Ef9089B7142B6B908Dc3A8af7Aa8ff0FA1 Which corresponds to empty mnemonic .

Apart that it's bug itself, another point is that empty mnemonic (or undefined mnemonic) already in blockchain bandits set. And this may at some point put Status not into good light when users (those who will want to proceed account recover with misspelled seedphrase), thinking it's their lucky day (there are already some tokens live in this address) realise their funds were transferred out immediately. And user will blame Status in that case.

Expected behavior

Private key recovered according to seed phrase entered in the input when recoveing account.

Actual behavior

Disregard the seed phrase with the words outside Status dictionary, - mnemonic value passed is unknown which results in the same account with address 0x959FD7Ef9089B7142B6B908Dc3A8af7Aa8ff0FA1

Screenshot 2019-10-28 at 17 00 24

Notes

For the developer who will be investigating. Is it related to another PR? Tips on where to start?

Acceptance Criteria

Reproduction

Additional Information

Serhy commented 5 years ago

@rachelhamlin due to reasons explained in the description I included in V1. Makes sense to bounty as fo me, apparently we fail to grab the seedphrase value after ...some words might be misspelled... pop-up submission

Serhy commented 5 years ago

This issue is a bit different from #9062 but likely touches the same module. I'd keep this one open and if we fix it along with #9062 it will be great!

Serhy commented 5 years ago

With @rachelhamlin 's help found there is a separate issue https://github.com/status-im/status-react/issues/9050 which dealing with seed phrase words outside of the BIP29 list which may fix this issue as well. Keeping this issue open until #9050 is addressed.

StatusSceptre commented 4 years ago

Think we can close this one @Serhy? I don't foresee us needing to fix it so long as we are preventing users from recovering non-dictionary seedphrases.

Serhy commented 4 years ago

Okay. Agree to close as #9050 should automatically fix this issue too.

GENERALGUBERNATOR1 commented 4 years ago

0x959FD7Ef9089B7142B6B908Dc3A8af7Aa8ff0FA1 этот кошелек фишинг у меня есть ключ но я не могу закончить ico я отправил свои токены сюда как вытащить их мне перенаправляют фишинг на другой кошелек