You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
With this small change/bug, the user may recover the wrong account using the same seed phrase. As a result, they might request funds or take other actions on an account whose seed phrase is unknown to them.
We need to add tests (possibly also in the onboarding flow) to ensure that the correct account is recovered.
If provided value is not vector, after above change, seed phrase becomes this
Old: start course intact drastic coffee heavy orphan all barrel quarter allow pupil
new: s t a r t c o u r s e i n t a c t d r a s t i c c o f f e e h e a v y o r p h a n a l l b a r r e l q u a r t e r a l l o w p u p i l
Anyone knows why we are still able to create account after this change, and why it is different? cc @flexsurfer@ilmotta
The text was updated successfully, but these errors were encountered:
I think we should not ignore this by considering, why we are making above change, if its not vector.
While developing, we might not always be fully aware of the nature of the data. For example, in the same file, we have many instances of masked-seed-phrase and masked-phrase-vector. It's unclear why some events return a vector and others return a string. A developer might accidentally copy-paste vector-related code and use it for a string. I personally did this when developing the recovery phrase flow for Keycard. However, since this was a sensitive area, I double-checked to ensure that the recovery phrase was recovering the same account in both flows (onboarding and Keycard), which helped me avoid this bug.
Problem
Prerequisite:
Result:
Same seed phrase different account.
signal-2025-02-28-152219.mp4
Consequences
With this small change/bug, the user may recover the wrong account using the same seed phrase. As a result, they might request funds or take other actions on an account whose seed phrase is unknown to them.
We need to add tests (possibly also in the onboarding flow) to ensure that the correct account is recovered.
If provided value is not vector, after above change, seed phrase becomes this
Anyone knows why we are still able to create account after this change, and why it is different? cc @flexsurfer @ilmotta
The text was updated successfully, but these errors were encountered: