Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Seed is not validated from GRPC #70

Open
musashidev opened this issue Jul 3, 2020 · 1 comment
Open

Seed is not validated from GRPC #70

musashidev opened this issue Jul 3, 2020 · 1 comment

Comments

@musashidev
Copy link
Contributor

The mnemonic seed provided for the creation of a new wallet is not validated.

It is created with the method NewSeed from github.com/tyler-smith/go-bip39
The same library provides tools for validating the seed that could be used.
This issue could lead to the creation of insecure wallets from unaware developers.

Also unrelated: for using a SPV wallet with --noinitialload something like this could be implemented,

if cfg.NoInitialLoad {
	// Ensure the data directory for the network exists.
	if err := checkCreateDir(netDir); err != nil {
		fmt.Fprintln(os.Stderr, err)
		return nil, nil, err
	}
}

Thank you for this project!

@cpacia
Copy link
Contributor

cpacia commented Jul 3, 2020

Thanks for pointing it out. I think it's a question of how much flexibility do we want to allow.

Technically the bip39 spec allows for using any string as a mnemonic as the string is just hashed to create the seed. So validating the mnemonic against the word list, while possible, does reduce that functionality. But maybe it's something we should do for safety.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants