Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mnemonicToWalletKey() does not report mnemonics with typos #1

Open
talkol opened this issue Mar 2, 2023 · 3 comments
Open

mnemonicToWalletKey() does not report mnemonics with typos #1

talkol opened this issue Mar 2, 2023 · 3 comments

Comments

@talkol
Copy link

talkol commented Mar 2, 2023

Consider these two snippets:

const mnemonic = "priority road check curious obvious ...";
const key = await mnemonicToWalletKey(mnemonic.split(" "));
const wallet = WalletContractV4.create({ publicKey: key.publicKey, workchain: 0 });
const mnemonic = "priority road check curious abvious ..."; // obvious has a typo = abvious
const key = await mnemonicToWalletKey(mnemonic.split(" "));
const wallet = WalletContractV4.create({ publicKey: key.publicKey, workchain: 0 });

They both pass smoothly and return different wallet addresses.

This is very dangerous. Consider that somebody has a mnemonic and the code that creates a wallet in software has a typo. He would end up reaching a different address by mistake. Send it funds. If this code is ever deleted and they try to recover the wallet from the written mnemonic, they will not make the same typo again, and the money will be lost.

Wanted behavior - Throw an error from mnemonicToWalletKey on any problem with the mnemonic (not enough words, too many words, words not in the dictionary, checksum of mnemonic doesn't add up).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants
@talkol and others