Quote from: j4y_naKomodo on December 16, 2017, 01:32:42 AM

Greetings, friends at Machinecoin! As Komodo Platform has been working around the clock to fine-tune the multiple GUI's that are the face of our Agama multiwallet and BarterDEX atomic swap protocols, there have obviously been many bugs found and many debugged. However, one bug in particular was found not only in our Agama GUI wallet, but also in the zcash4mac GUI swing wallet. It is a simple bug, but it warrants your attention. This is a potential money cost bug, and as a Bitcoin-protocol cryptocurrency, your GUI wallet(s) may be susceptible. We are reaching out directly to the developers and communities of the 60+ coins featured on Agama and BarterDEX as the bug may have a direct impact on you (via your own wallet).

watchonly-GUI bug: 'watchonly' addresses appearing as your own in GUI wallet; users could potentially send funds to the address, unaware it is not theirs or available for withdrawal. You can import and it becomes a 'watchonly' address. The GUI will display the address as yours, add its funds to your balance, and accept deposits, but cannot be withdrawn. This could be a normal address, my address, a p2sh address, satoshi's address, etc. This can be confusing to an end-user and will lead to many headaches for the developer, as is always the case with misplaced funds.

FOUND: in Komodo Platform's Agama multiwallet (fixed) and zcash4mac GUI swing wallet (@jl777B: "newest QT wallet seems ok about watch only, but not sure of older and when it was fixed")

ex. @grewalsatinder found the bug in his zcash swing wallet:

Quote from: jl777B

"satinder used zcash4mac, ie. the zcash osx GUI, not ours... the assumption is no GUI out there properly handles watch only addresses, until proven that they do... agama also had this bug, which we found and fixed, so it seems a very common bug to have"

SOLUTION: For the 'watchonly' address or any address not yours, the value 'ismine' returns false. Any such address gets filtered out.

QUESTIONS:

How does your recommended GUI deal with watchonly addresses?
Does your GUI display watchonly addresses as different than actual addresses in the wallet?

We need to experiment a bit to see which approach gets a better response triggering the bug. People WILL lose money if they send funds to a watchonly address.

Quote from: jl777B

"the t3 addresses in the 'Own Addresses' column! and they absolutely cant be as they are p2sh addresses. it is clear proof that the bug is very real and anybody that understands a p2sh address will understand it cant be something in your wallet. it is usually a multisig address, so only if it is a 1of1 multisig (possible but very silly) can you have a p2sh address that is spendable, but the wallet wont even know it... normal addresses can also be watchonly, which makes this even worse. in that case it would appear in the list of addresses just like all the others. even if you are able to spot p2sh addresses visually, it wont be enough"

We want to spread awareness and facilitate discussion of this bug to minimize the impact.

Of course - we can always talk about how you can use BarterDEX today to trade Machinecoin via atomic swap directly with your peers, through our beta GUI and without downloading the entire blockchain ; ) That is how we found the bug, afterall.

Stay safe,
Jay

Hey Jay,

thanks for letting us know about this.

I can confirm, that this "bug" is appearing at the latest Machinecoin Core 0.14.2 and may be confusing for most users and a risk for losing coins (see https://gyazo.com/25fdb2e3be7aa41ee900e4c6ecadf6ec).
I'll work on a solution to clarify the difference between "normal" and "watchonly" addresses within the GUI, which will get pushed with the next core version (most approx. 0.15.x).

Friendly Regards
- SkycityVictorians