search

trufflesuite / ganache

:warning: The Truffle Suite is being sunset. For information on ongoing support, migration options and FAQs, visit the Consensys blog. Thank you for all the support over the years.
https://consensys.io/blog/consensys-announces-the-sunset-of-truffle-and-ganache-and-new-hardhat?utm_source=github&utm_medium=referral&utm_campaign=2023_Sep_truffle-sunset-2023_announcement_
MIT License
2.61k stars 676 forks source link

Validate mnemonic #4075

Open davidmurdoch opened 1 year ago

davidmurdoch commented 1 year ago

Ganache allows any mnemonic, even if it isn't valid. We should stop allowing that. It wasn't on purpose.

If people liked being able to make their own mnemonic out of whatever words they wanted, maybe we can add that in as a flag.

tenthirtyone commented 1 year ago

Wild and Crazy Time -> I think a proposal should be written for a BIP-32 HD wallet compliant path for development.

This should be standardized because the decision to run production values in a development environment should be opt-in.

Standardizing a development HD wallet path would:

  1. 'namespace' these keys from production keys.
  2. Avoid production networks from selecting wallet paths that could be used in development
  3. Give users the ability to move the mnemonic between standards compliant tools.
  4. Avoid lost eth from production transactions sent to devnet addresses (I cannot quantify this, it could be 0).
  5. Allow tools like Ganache to still validate the production mnemonic without computing/exposing the production keys to the dev environment and network.
  6. Potentially reduce the risk on cloud-based scenarios since the in-memory keys are no good in prod and I assume we will compute the private keys from the mnem on the client side so the mnem is never transmitted over the wire or touching remote machines.
  7. Increase developer tooling compatibility between EVM compatible networks.

I think our team should lead this effort and reach out to other dev teams for input, feedback and thoughts.

(I am behind on EIPs and ERCs so if something like this is out there or if this makes zero sense . I'm also a wee bit rusty on HD wallets)