Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Seed Phrase Bug Bounty #3127

Open
danfinlay opened this issue Jan 29, 2018 · 214 comments
Open

Seed Phrase Bug Bounty #3127

danfinlay opened this issue Jan 29, 2018 · 214 comments

Comments

@danfinlay
Copy link
Contributor

danfinlay commented Jan 29, 2018

As part of our commitment to the best security we can offer, the MetaMask team is planning to continuously offer a bug bounty on our seed phrase functionality, we are starting the bounty at 1 ether, but anyone is free to add to the bounty as they like.

As we have written about before #2577, and have awarded a bounty for in the past, sometimes users have reported that the seed phrase they were originally given does not restore their original accounts.

We have continued to receive rare but concerning accounts of similar experiences: #2904 #3042 #4756 #4697

The bounty will be paid to anyone who can demonstrate a condition in MetaMask's code base, either through automated tests or manual reproduction, where MetaMask would show a user a seed phrase on first setup that would not work for later restoring their accounts.

Thanks for your interest and participation, we're available to answer any questions about our key management here.

@gitcoinbot
Copy link

This issue now has a funding of 1.0 ETH (1189.64 USD) attached to it.

  • If you would like to work on this issue you can claim it here.
  • If you've completed this issue and want to claim the bounty you can do so here
  • Questions? Get help on the Gitcoin Slack
  • $47191.73 more Funded OSS Work Available at: https://gitcoin.co/explorer

@ghost
Copy link

ghost commented Feb 1, 2018

I had same issue with MetaMask chrome extension, a month back, i can reproduce what happened with my account. As i have not read MetaMask's code base, my understanding of seed phrase is limited. But what happened is still a issue.

@danfinlay
Copy link
Contributor Author

i can reproduce what happened with my account

If you can reproduce a problem that meets this description reliably, you'll be eligible for this bounty, no need to understand the code.

If you'd like to disclose it in secret, please submit your reproduction steps to [email protected]

@ghost
Copy link

ghost commented Feb 2, 2018

On reading documentation and concept of loose accounts, what happened with my account was, i had imported few accounts with "import account" option, but after reinstalling metmask extension, these imported accounts were gone, luckily i had private keys for these imported accounts, so i had to import these again. In that sense "seed phrase" will only create HD wallet, and will recover only addresses in its derivation path?(Not the previous full state of your account).

@danfinlay
Copy link
Contributor Author

That's right, the seed phrase is not a password to some server we maintain, it is the secret from which we derive the accounts that you create with MetaMask. It can't help with restoring any other information.

Glad you figured it out!

@wong2
Copy link

wong2 commented Feb 4, 2018

Why is this closed?

@ghost ghost mentioned this issue Feb 12, 2018
@vs77bb
Copy link

vs77bb commented Feb 13, 2018

@danfinlay Is this one still open? cc @owocki

@danfinlay
Copy link
Contributor Author

Sorry, I didn't mean to close this!

@owocki
Copy link

owocki commented Feb 22, 2018

working on some issues with gitcoinbot erroneously commenting on issues... looks like it might have happened here. sorry yall, working on it!

@owocki
Copy link

owocki commented Feb 22, 2018

just put in a fix for the gitcoinbot craziness. gonna monitor for the next few hours to make sure we're all good.

@imcda
Copy link

imcda commented Feb 24, 2018

Hi @danfinlay

METAMASK is really a good wallet. I am a fresh user of METAMASK, and teach my girlfriend to use it. Last night when we use it to join an ICO campaign. We got the TERRIBLE problem. DEEP SAD! We lost our all accounts although we take down the seed prase.

the reproduce progress as below:

  1. we created an account, setted a password and took the seed prase,this is Account 1;

  2. then we created Account 2, 3, 4, 5…… it very easy and there is no seed prase or password (I think this is the important reason)

  3. then we use the address to join the ICO, but we clear all the cache of the browser (this is why my accounts lost )

  4. when we login the metamask use the seed parse and reset the password, we only find the Account 1. the other accounts lost.

That's quite terrible! We lost many tokens which cost us a lot. And I didn't find a good way to get back the account. Maybe never. It really a big BUG, and Why don't you alert users to avoid it? Some advices as below:

  1. Alert all the user one seed parse can only recover the first Account.
  2. if you clear the cache of the browser, you will lose all the accounts.
  3. you should download or takedown every acoount's private key.

Good product but with quite big BUG for fresh users. Hope others good luck. :( a sad day for me.

@DanielRX
Copy link

DanielRX commented Feb 25, 2018

EDIT: @DavidFnck if you press create account it will restore the rest, only account 1 shows but the rest will be there if you create account again

One thing to note, when I clear cache and use the password, it claims to be wrong (it was copied from a text file for testing) so I had to use the seed phrase to restore

@BinaryQuasar
Copy link

BinaryQuasar commented Feb 25, 2018

@DavidFnck The accounts should be restored one-by-one when you perform "create account" in the fresh MetaMask.

EDIT: @DanielMReed edited their comment to say this as well.

@BGzetro
Copy link

BGzetro commented Feb 27, 2018

I'm offering up to 20% of my account balance as a bounty if I can gain access to my original address again after being effected by this bug. The bounty I'm offering is worth than the bounty of this issue no (#3127) alone. The issue I created is no #3258 it has been closed but not solved and is the same issue as this one.

@BGzetro
Copy link

BGzetro commented Feb 27, 2018

My original address balance can be seen here and is where I'll pay the bounty out from on regaining access:

https://etherscan.io/address/0xbc70688f0394d98c6016f670d2e2515d0ef63533

@BGzetro
Copy link

BGzetro commented Feb 27, 2018

If the balance increases in value so does the bounty I'm offering i.e 20% of whatever my address is worth at the time of gaining access.

@crz101
Copy link

crz101 commented Jan 12, 2022 via email

@crz101
Copy link

crz101 commented Jan 16, 2022

SORRY GUYS I was wrong, I did mess up with the SPRs. now I found the original and recovered my accout.

@Bcrrv
Copy link

Bcrrv commented Jan 17, 2022

Hello @MomOfTwins1 I was away for work but know I have got some days off, I did try everything but nothing has changed...

it seems that @crz101 found a way around with the SPRs do you know anything about this solution?

@crz101 would you kindly explain what is SPRs and how you manage to recover your original wallet address using them?

thanks in advance for you help.

@crz101
Copy link

crz101 commented Jan 17, 2022 via email

@Bcrrv
Copy link

Bcrrv commented Jan 17, 2022

@Bcrrv I found the SPR belongs to the right one. It is my fault to mess it up. So I don’t think it’s a bug anymore. 获取 Outlook for iOShttps://aka.ms/o0ukef

________________________________ 发件人: Bcrrv @.> 发送时间: Tuesday, January 18, 2022 2:54:15 AM 收件人: MetaMask/metamask-extension @.> 抄送: crz101 @.>; Mention @.> 主题: Re: [MetaMask/metamask-extension] Seed Phrase Bug Bounty (#3127) Hello @MomOfTwins1https://github.com/MomOfTwins1 I was away for work but know I have got some days off, I did try everything but nothing has changed... it seems that @crz101https://github.com/crz101 found a way around with the SPRs do you know anything about this solution? @crz101https://github.com/crz101 would you kindly explain what is SPRs and how you manage to recover your original wallet address using them? thanks in advance for you help. ― Reply to this email directly, view it on GitHub<#3127 (comment)>, or unsubscribehttps://github.com/notifications/unsubscribe-auth/AE6A2KI6SPQSCID2DTJRUH3UWRQVPANCNFSM4EOFCM7Q. Triage notifications on the go with GitHub Mobile for iOShttps://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Androidhttps://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub. You are receiving this because you were mentioned.Message ID: @.***>

Oh,now I understand what you mean ,SPR meaning seed phase recovery....
I'll keep trying.
Thanks for your answer.

@MomOfTwins1
Copy link

Hi Alejandro @Bcrrv. Sorry to hear that everything you tried didn't work. May I ask what exactly did you try?

@crz101, glad you recovered your access. I will delete the messages with all the screenshots I have posted for you, as it makes difficult to read the thread . Anyway, your case was not related to the issue.

@hyun305
Copy link

hyun305 commented Feb 2, 2022

@danfinlay @MomOfTwins1 - Can you help me please? I used my secret seed phrase and restored my MM desktop extension but my main account is not showing correctly. It shows the same public address as my main account but has upper case letter in some of the letters when they should be all lower case. This is making my MM desktop account unrecognizable to my open sea account. I double checked the seed phrase on my MM mobile and I am 100% sure I’m putting in the correct seed phrase. Also, my MM mobile has the correct wallets and information it’s just my desktop extension that is showing incorrect information even the total balances are all off in my desktop extension appose to my mobile app. Also, my MM desktop extension doesn't show any of my NFTs or my funds correctly.

To make matters worse, I'm able to see my account 2 on my MM desktop and it's the same as for my mobile but the balance on my MM desktop is not correct and hasn't updated at all since I restored my MM desktop extension.

@MomOfTwins1
Copy link

Hi @hyun305. From what I understand you have the correct seed phrase, just for some reason your account's address was not originally checksummed (only lower case letters). I think it's better to submit a ticket to the MetaMask support team. Here is a link:
https://metamask.zendesk.com/hc/en-us/requests/new
Also, you can try (but I'm not sure it will work) to download MetaMask extension on another session or browser, to see if it gives you again non checksummed public address.

@hyun305
Copy link

hyun305 commented Feb 2, 2022

hi @MomOfTwins1 - thanks for your reply and I tired another session of metmask on firefox and still loading the main wallet with uppercase letters but the balance of funds are correct and still missing my NFTs in my main wallet. I created a support ticket with metamask over 16 days ago and still haven't heard anything so I was trying to find my answer through these communities. I'm just at a loss.

@nano242
Copy link

nano242 commented Feb 10, 2022

made a metamask account yesterdat, deposited money and left it to buy an nft mint. Woke up this morning used my seed phrase to log in change password. Whole new public address is used. My old address with my money puff gone just like that loving life rn

@MomOfTwins1
Copy link

MomOfTwins1 commented Mar 18, 2022

As already mentioned in post #3127 (comment) I have experienced this issue, meaning after reinstalling the MetaMask extension and importing my wallet with my usual seed phrase a new Account 1 (with 0 balance) showed-up. I was able to recover my Account with funds as the bug happened again on my device under another Chrome session and the usual seed phrase allowed me to connect to the right Account.

It took me 2 months to find on my device a seed phrase which my Account with funds really belongs to. I had never seen/used this seed phrase before. However, the numerous keyring/vault data present on my device and containing this seed phrase has 3 different passwords. 3 passwords means that that seed phrase was imported at least 2 times (1st password = creation; 2nd – first import; 3rd password – second import). To import a wallet, it is a MUST to enter/type that seed phrase. I never did that. And I’m not suffering from amnesia. 🤣 It means this seed phrase was actively used by some processes in the background by MetaMask extension.

What I reproach to the MetaMask extension, is that it doesn’t reproduce on the UI (user interface) what it is actually doing on the blockchain. And people are losing their hard-earned money. 🙁 Their access to it actually, but it is the same.

The guide I provided on November 14th didn’t help people recover their accounts/funds till now.

As I have mentioned already in a previous post:

Guide 1 is invalid, as the private key in the Web Data is there due to my manipulations on my device, and not due to the issue.
Guide 2 also might not work either, since, as mentioned by one MetaMask team member, the "broken format" was not actually corrupted when using a proper leveldb parser utility, hence just a side effect of some of the leveldb encoding. So searching the vault in "broken" format would not work either, since it is possible that for some users it is not "broken" or even "broken" differently, depending on the device and encoding.
Guide 3 use the logic "gather all vault data" from your device and recovered files, and decrypts one by one non-identical values. It was not well explained.

So please find below Guide 3 improved. I really hope this new version helps.

From my own experience and other cases there are 2 possible situations when the Account 1 is different while using one's usual seed phrase. First one is “Jump in”, and is very easy to fix. Just make a fresh install of the MetaMask extension (or other wallet, as Trust Wallet or MEW) on another browser, device, phone…. Your usual seed phrase will bring you to your right account.

“Jump out” - you need to find a seed phrase which your account really belongs to. This guide is about this second situation. But as a first step, you should try all the seed phrases you know of, even if they belong to other wallets. This will save you time.

Find the lost account

‼️ ABSOLUTE PREREQUISITE: You need to use the device (laptop, desktop, …) you were using with the usual seed phrase while your Account was the right one (with funds) ‼️

  • For Windows

  • Any Browser.

⛔ You need to stop downloading/installing anything on your hard drive and stop creating any large files such as personal videos/music ! ⛔

Step 1. Prepare your device and external drive with enough capacity

1.1. You need an external drive with enough capacity (no less than 500 Gb).

image

1.2. Go to System ➡️ Storage ➡️ Change where the new content is saved ➡️ Choose external drive for each option ➡️ Apply 🔄 Restart your device ⚠️

If you remove that drive from your computer, Windows will default to storing files in the original location on your C: drive until you plug the external drive again. So keep it plugged in for now. ⚠️

Visual: For a better resolution and a pause option: https://youtu.be/oj6CMnhFVY0
step 3 modified

Step 2. Prepper your tools

2.1. Download and install your tools (on your external drive):

Recuva - Free Download (ccleaner.com; Customize ➡️ More ➡️ Your External Drive

AstroGrep (sourceforge.net) ; - Browse ➡️ Your External Drive

Atom - (:no_entry: download only, do not install for now, as it can overwrite your deleted files because it’s installing direcly on drive C:)

MetaMask Vault Decryptor – Right click ➡️ Save as ➡️ Your External Drive

Visual: For a better resolution and the pause option: https://youtu.be/_M72Pwc_L5U
Step 2

Step 3. Recover/copy the files with vault data

(existing and deleted)

3.1. Run Recuva ➡️ Cancel ➡️ Options ➡️ Actions Tab ➡️ Choose all cases ✔️ It’s a very important step. ⚠️ ⚠️ ⚠️

3.2. Scan ➡️ Scan content with \"salt in all *.* files ➡️ Scan ⚠️ ⚠️

🕦 It can take a few hours 🕦

3.3. Once finished, press the Recover button and choose the location on your External Drive. Then create a new folder, for example “Vault data found”

🕦

It was the most important part, saving the data. You can now take a break from here.

Visual: For a better resolution and the pause option: https://youtu.be/CUiXp6vrdk0

4. Search/decrypt the vault data

4.1. Install Atom image just by clicking on the AtomSetup-x64.exe.
4.2. Run AstroGrep
Serach path - the folder you created with files from Recuva
File Types *.*
Search Text \"salt
Search Options Search subfolders, 2 Context Lines
Exclusions deselect all exclusions
Execute Search

🕦

It was not possible to embed a GIF Visual since it was too heavy. You can follow it on YouTube https://youtu.be/S80v-t_llPw

⚡ 🔑 Note, for decrypting the data you would need to try all your usual passwords. You may also try all of them with “Caps Lock” activated. 🔑 ⚡

This guide is not perfect, but it is functional. Hence I decided to publish it even though the work was not finished (interrupted due to the situation in my birth country). Peace and love to all human beings. 💙💛

@AgCaliva
Copy link

AgCaliva commented Apr 21, 2022

@danfinlay
Hi. Bounties are for mobile seed phrase bugs too?
Im a little confused abount since when those bugs have been started to being reported, and which issues got solved or at least verified that they dont have the whitespace error between seed? Maybe it could help if someone tells a little about since when this bug exists and which versions are more involved on issue. Thank you very much sory my english its not good.
Someone knows if the whitespace char between seed phrase words error have been solved? Is metamask replacing bad whitespace characters with valid ones?
There is any channel in which i can talk to some dev if have questions? Metamask use discord for this?
I wanted to ask also if there is any bounty for hardware wallet bugs, stacking or any other main function and if thats the case how much are most of the time getting paid those bounties?. I guess it depends on issue, in the hypothetical case of finding a stacking bug only for one or two not little blockchains how much do you think it can get paid?

@AgCaliva
Copy link

AgCaliva commented Apr 28, 2022

@danfinlay i see someone its reading my comments:
GHSA-c2xw-px2x-pr65
But dont care to answer. Ok. Will look other bounty sources. Good luck.

@Maikeloneate
Copy link

Please ,Greetings, I have this same problem for an android mobile, is where I have always used metamask and then trying to use it metamask on the pc, I use the phrase seed and it opens a new empty account, I only have one wallet, I do not have multiple accounts or anything like that try on 2 pc and another ipad and it does not open my wallet, everything I have read here works for pc but nothing for android.

@AgCaliva
Copy link

AgCaliva commented May 19, 2022

Please ,Greetings, I have this same problem for an android mobile, is where I have always used metamask and then trying to use it metamask on the pc, I use the phrase seed and it opens a new empty account, I only have one wallet, I do not have multiple accounts or anything like that try on 2 pc and another ipad and it does not open my wallet, everything I have read here works for pc but nothing for android.

Maybe not a bug? i think extension and mobile are different types of wallets, meaning that you should be able anyway to import your wallet by using the private key as far as i know which its agnostic to implementations. If that dont works then maybe its a bug.

@MomOfTwins1
Copy link

Hi @Maikeloneate, do you still have the accesse to your account on Android?

@WalaVita
Copy link

WalaVita commented Jun 21, 2022

Hi, @MomOfTwins1

Very clear explanation. Hope it can save me.
: (

@MomOfTwins1
Copy link

Hi @WalaVita. AstroGrep should work, try it again. Hope your problem will be solved. Kindly please, keep me updated wether it worked out for you or not.
Wishing you good luck.

@MomOfTwins1
Copy link

MomOfTwins1 commented Aug 21, 2022

@herufer, issue: https://community.metamask.io/t/the-seed-phrase-has-not-been-restored-to-my-original-account/22447/16 as my message doesn't get through on the MM community.

Sadly, I do not know what is wrong neither… 🙁
You didn’t mention in your issue description, which browser do you use for your MetaMask wallet? (Chrome, Edge… ?)
Another question, the device you analysed with Recuva is the same device you used to create your MetaMask wallet?
Have you ever been using this walking on another device? (Phone, another desktop/laptop, tablet…)
And also, have you ever created any other MetaMask wallet (with different seed phrase)?
Just to shear what I understood about the issue, there is a possibility while using multiple MetaMask wallets on the same device (or even different devices but with synchronised browser extension across the devices) that an Account from one seed phrase might be imported to another seed phrase with no mention it was an imported one.
In my case it was a seed phrase I created while I was not even sure I would use any crypto. I just followed a YouTube explanation to see if it was difficult to create/use MetaMask just for fun. Of course I never noted/saved this seed phrase (it was on Edge browser synchronised with Chrome account via an e-mail, and for some reason, probably a synchronisation option, MetaMask created a nkbi… folder instead of normal folder using with Edge that folder is called ejbal….) Then, later, when I made the decision about the crypto, I used Chrome browser to create a real MetaMask wallet, and printed out the seed phrase right away. What was strange, the seed phrase was showed twice, the second time on the « black output » like this
adjust SRP

Do not worry, it’s an empty wallet 🤣 There where all the problems started for me. Actually, the Account 1 that was displayed on MM never was one from that seed phrase, but from my test wallet! I learned it much more later… it is not mentioned on GitHub and I had no time to update it there.
But that's not all. I created another MM wallet later, on a different Chrome profile. Account 1 was right. No black screen either. But later, the MM extension didn’t accept the password, so I had no choice but to import the seed phrase. And here - an Account 1 from my test wallet was shown as native one for this new seed phrase.
Do you recall if you had some similar experiences while creating your wallet (black screen or seed phrase displayed multiple times) ?
The experience of another user seems to be similar. Multiple wallets and the « jumping Account 1 » from one seed to another : #3127 (comment)

Also, some other experiences, https://community.metamask.io/t/mom-of-twins-lost-metamask-account-pdf-helper-please/13906/66 seem to match the same scenario.

@Starish971
Copy link

Starish971 commented Jan 18, 2023

Hello everyone,

First for all of the people who tried to solve it and shared the problem thank you it helped a lot of people like me.

I have the same problem as you.

  • In june 2021 i sent to my metamask address (0x3) some eth from my binance account
  • i never received the fund thus as a old school delete and reinstalled metamask
  • Nothing and my wallet address changed to (0x5)

I made a mistake by sending from binance to the wrong network (BSC) but even with the wrong network we can retrieve the fund.

My problem is that to retrieve it i need to add the binance network to the original address

What does I know :

  • recovery phrase
  • the exact date of my mistake thus the metamask version
  • i can see my address on bscscan and on etherscan its blank (normal due to weong network)

I tried to :

  • add the binance smart chain AND token
  • the recovery from metamask FAQs (this confirmed that i had the original seed phrase)
  • add MM account to find the original address
  • old version of MM metamask + brave

Something strange :

  • when i try to add the original (0x3) as a token it tell me personal address detected

Thank you for reading
Will update soon on the brave solution

@HazelContreras
Copy link

HazelContreras commented Aug 10, 2023

I’m having the same issue when trying to retreive my reddit Vault in the MM iOS app. The address in MM doesn’t match my Reddit address. I triple checked!

edit: tried the seed phrase in the myetherwallet iOS app. Same address as the MEW address.. but NOT my Reddit Vault address. Now what..

@AgCaliva
Copy link

AgCaliva commented Feb 7, 2024

I have tried to work on this issue on Apr 28, 2022, @danfinlay never answered nothing, it seems there is no bug bounty for mobile, i have seen the code at that time and was probably buggy, thats why i asked if the bug bounty includes mobile. Then the team started to correct the code, and i never received an answer.
We can conclude that the bug bounty does not include Mobile wallet, and probably the funds of the people that talk about Mobile version probably are lost forever. Im not 100% sure but thats probably why he never responded.
Sad and ugly.
Indeed its more than just sad and ugly, since i have mentioned some clues about where was the bugs, they/he readed my comments, used the data to solve it, and never answered.
Just close this issue. Nowadays they dont believe that bounties can solve something, or maybe they dont want to pay nothing to someone external to the team or someone that highlights their errors.

@ofTarradiddle
Copy link

ofTarradiddle commented Mar 8, 2024

The other thing I noticed, as I am also affected by this, is that the old address is indicated in my MM state-log in a list designating ignored addresses. I am not sure what this means, but that the seed phrase I currently use to restore addresses was at one time related to the address that I originally sent my coins to. Wondering if anyone else can verify if they see the address with their coins also listed in a similar state-log list? @Starish971

@danfinlay Any thoughts on why the lost address would show up in the allignoredtokens list?

@jcalv13
Copy link

jcalv13 commented Jul 19, 2024

I have the same issue whereby my seed phrase does not restore my wallets. My initial accounts were made on firefox metamask extension.
I went to restore same accounts in chrome extension with the given seed phrase & have an empty wallet. When entering my metamask password to reveal seed phrase for both different extensions, I am given the same seed phrase. I imagine this to be a problem should I lose access to one of the accounts. Any solutions?

@ofTarradiddle
Copy link

@jcalv13 The above dialogue seems to suggest we were given seed phrases for an alternate wallet when we first generated our wallet. When logging with this seed phrase we get redirected to an alternate wallet, with the original seed phrase never communicated visually. I agree, hoping someone at meta mask is working on this.

@ofTarradiddle
Copy link

@danfinlay Never responded to my initial request for info from march.

@jcalv13
Copy link

jcalv13 commented Jul 19, 2024

@jcalv13 The above dialogue seems to suggest we were given seed phrases for an alternate wallet when we first generated our wallet. When logging with this seed phrase we get redirected to an alternate wallet, with the original seed phrase never communicated visually. I agree, hoping someone at meta mask is working on this.

Oh wow this is even worse than I had thought. I hope you have access to your wallet & have stored all your private keys somewhere safe? This is my course of action now.

@ofTarradiddle
Copy link

@jcalv13 Except, if the above is true, the seed phrase you have will never get you access to your original wallet.

@AgCaliva
Copy link

AgCaliva commented Jul 29, 2024

I can help people with problems in PC, for those with mobile problems in my opinion nothing can be done.
Write me to [email protected] sending:
OS
Aprox date wallet was created
Browser
Explanation

If i recover your wallet i expect donations. ty

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests