MetaMask / MetaMask/metamask-extension

Support multiple seed phrases

Open
#9,438 2 comments 1 reaction 0 assignees View on GitHub
area-seedPhrase external-contributor INVALID-ISSUE-TEMPLATE needs-design type-enhancement
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

**Describe the bug**
Once the user 'recovers' his account using the seed phrase, all existing accounts on Metamask are removed.

**To Reproduce (REQUIRED)**
Steps to reproduce the behavior, libraries used with version number, and/or any setup information to easily reproduce:

1. Say we have 2 accounts in our Metamask:

![Screen Shot 2020-09-18 at 11 25 37](https://user-images.githubusercontent.com/3002249/93609245-f98c6500-f9a1-11ea-8945-14da5e7326e5.png)

2. We want to add a new account from its seed (that we already have), but deceptively we can't find the option to add a seed (it seems only to be possible when adding the very first account, right after installing Metamask. After that, it is only possible to create new seeds or import existing wallets using a private key or JSON file).

![Screen Shot 2020-09-18 at 11 28 51](https://user-images.githubusercontent.com/3002249/93609390-2b053080-f9a2-11ea-8386-5bcc8d179500.png)

3. Perhaps we need to logout? Let's try. Oops, there is something about recovering a wallet using its seed phrase on the login screen!

![Screen Shot 2020-09-18 at 11 25 47](https://user-images.githubusercontent.com/3002249/93609518-58ea7500-f9a2-11ea-8de2-826e8749e214.png)

4. Mkay, let's import it.

![Screen Shot 2020-09-18 at 11 26 04](https://user-images.githubusercontent.com/3002249/93609751-9c44e380-f9a2-11ea-8536-4d3c9c08b47a.png)

5. It worked, but... All the other accounts are gone.

![Screen Shot 2020-09-18 at 11 26 18](https://user-images.githubusercontent.com/3002249/93609594-6e5f9f00-f9a2-11ea-96b0-66237a22e60e.png)

**Expected behavior**

- After importing a seed, other accounts should not be erased.

- There should be a way to import existing seeds when adding a new account. So far it only seems to be possible after installing Metamask, on the welcome steps:

![image](https://user-images.githubusercontent.com/3002249/93610066-f776d600-f9a2-11ea-876b-f3d8e4008ef7.png)

**Browser details (please complete the following information):**
- OS: macOS
- Hardware Wallet none
- Browser Chrome 89

**Additional context (Error Messages, etc.)**

There is some technical limitation here: as Metamask stores the seeds encrypted with the user's password, once the user tries to 'recover' his account with a seed, it is impossible to tell whether such seed is really the existing wallet seed.

But from my point of view, choosing to fully wipe Metamask accounts because one account is being recovered is a wrong and dangerous design decision that may lead to loss os funds.

My opinion is that, since we cannot tell whether the seed the user enters matches the encrypted current wallet seed, such feature should not be offered as "recovering". Rather, the user should be instructed that, if he loses his password, he should create a new wallet (but in this case, we should offer the option to import a new wallet from its seed phrase, instead of limiting it to the first use) and delete the old one.

Anyway, wiping every wallet in Metamask because the user is trying to recover one of them is a very unexpected behavior.

**Edit**: it looks that Metamask stores some additional information regarding the wallet (including the wallet address), but I could not confirm whether such information is kept encrypted or unencrypted. If it is unencrypted, perhaps a check should be done if the wallet address generated by the seed matches the old wallet address. If it is encrypted, could storing the wallet public address unencrypted to perform this check lead to any privacy flaw?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the recovery flow from the login screen and the add-account flow described in the issue, using Chrome. Trace how importing a seed affects existing accounts and determine the expected behavior for adding another seed. Done means importing a seed no longer removes existing accounts and an existing seed can be imported when adding an account.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.