wearekickback / app

Front-end app for Kickback
MIT License
43 stars 48 forks source link

Changing accounts during event signup + new user allows attending without user account #72

Open beyondlogical opened 5 years ago

beyondlogical commented 5 years ago

Hi Kickback team! I was trying out your app for our DappDevs event and here's what happened.

  1. Pull up page of event, click to attend
  2. Click to sign transaction (acct#1 0xF454...2Bd3)
  3. Fill out new user info
  4. Click to register for event (acct#1)
  5. Insufficient funds! (Oops, wrong account!)
  6. Switch accounts (acct#2 0x4ea...458C)
  7. Sign transaction (acct#2) - now attending event... with no username or email stored for acct#2

Now I'm signed up for the event under acct#2, but the account info was stored for account#1. Acct#2 has no username, and cannot update the user info. I can successfully sign in under acct#1. I can sign in and create another account under#2. Initially my new username was still not showing on the event attendance page, even after a refresh that updates the username/icon in the upper right. Given a short time, it's now showing up.

Overall, not surprised that jacking the flow caused inconsistent state, and I was able to get things sorted out (except needing to create a second account with a different username.) Nice work!

Thoughts on addressing: allow user accounts to have multiple addresses, or confirm the event staking address matches the user account address of a valid account.

Some screencaps: image

image

image

image

image

image

jefflau commented 5 years ago

Thanks for logging this! I think the easiest way to deal with this is to listen to the accounts from metamask/dapp browser and if it changes we hard refresh the page