mycryptohq / mycrypto

MyCrypto is an open-source tool that allows you to manage your Ethereum accounts privately and securely. Developed by and for the community since 2015, we’re focused on building awesome products that put the power in people’s hands.

MyCrypto Web App

This repo stores the MyCrypto codebase. The code is served at app.mycrypto.com

Documentation can be found in our wiki

• Contributor Guidelines A must-read if you'd like to contribute to MyCrypto
• Getting your token added to MyCrypto
• Adding your Network or Node
• Adding your Web3 Wallet & Logo
• MyCryptoBuilds - access a build by commithash, PR number, or branch name without building it yourself!
• Enabling or disabling experimental features

Development / Build Requirements

• Node 12.14.1*
• Yarn >= 1.19.1**

On systems where a pre-built version of node-hid is not available (e.g. 32-bit versions of Windows and Linux), you additionally need Python (3+) and node-gyp installed.

<sub>*Higher versions should work fine, but may cause inconsistencies.
**npm is NOT supported for package management. MyCrypto uses yarn.lock to ensure sub-dependency versions are pinned, so yarn is required to install node_modules

***For users trying to build with WSL, you'll need to have install libpng via sudo apt-get install libpng16-dev.</sub>

Running the App

First, you must run yarn to grab all the dependencies. If you are ever having trouble with something, a good place to start is by trying rm -rf node_modules/ && yarn which will completely clear all your previously installs dependencies and re-install them from scratch.

Then, you can run various commands depending on what you want to do:

Development

# run app in dev mode in browser, rebuild on file changes
yarn start

A development server will be available on https://localhost:3000 If you're using Chrome, you will get a net::ERR_CERT_AUTHORITY_INVALID warning. To disable it you can your settings in chrome: chrome://flags/#allow-insecure-localhost

Staging

# builds app for staging
yarn build:staging

Production

# builds app for production
yarn build

Testing

Unit Tests

# runs all unit tests using jest
yarn test

End-to-end Tests

# runs all e2e tests using testcafe
yarn test:e2e

To debug E2E tests in the browser

yarn test:e2e:dev

You can also run a single file

yarn test:e2e:dev __tests__/dashboard.test.js

Environments

In development we use a .env file to define required values. The list is defined in .env.example. These values are made available to the React code through the dotenv webpack plugin. In production, the values are set through Github secrets and made available to the React app through the webpack.EnvironmentPlugin. NB. Since TestCafe has access to the node, the values are available at process.env and do not need to be cloned.

Product Analytics

We use product analytics to help us understand how to improve our features.

The collection of usage data requires the use of unique identifiers which are stored in the browsers local storage. The id is random and can be removed or reset in the Settings panel. This ensures that our product team can identify places to improve the product, while at the same time protecting the users anonymity.

We strive to provide access to the Ethereum blockchain in the most secure way possible, we refuse any dynamic script injections and only rely on HTTPS calls to the API. The calls are formatted using the excellant @blockstock/stats library.

Finally, since User privacy is part of our core values, we also take special care to ensure that the data we send to thrid-party servers is purged from any information which may be de-anonymised such as:

• Every analytics call is sent to a MYC hosted reverse-proxy, strip of the users ip address and browser fingerprint before being forwarded to the data-warehouse (in this case )

• never sending an ETH address or Transaction hash to our analytics warehouse.

Dependency verification.

The integrity hash is generated by base64 encoding the sha512 binary digest:

  openssl dgst -binary -sha512 <dependency>.tgz | openssl base64

The best way to verify the integrity hash of a yarn.lock is to compare the integrity hashes. This may be done manually.

1. Download tgz from yarnpkg host

2. Generate integrity hash for it (sha512 base64)

3. Unpackage tgz

4. Download files from Github at relevant tag

5. Diff the files from Github and the files from the unpackages tgz

     $ diff -r node_modules/<depedency> tmp/<downloaded_dependency>
   

mycrypto's Issues

Header image links to https://www.myetherwallet.com instead of /

This is a subtle one but I think it's worth addressing. When downloading the zip file of the project and opening the index.html file locally with a URL like:

file:///Users/JohnDoe/etherwallet-v3.10.0.2/index.html

The header image is for some reason hard coded to:

https://www.myetherwallet.com/

I wanted to submit a PR to fix this but I'm actually not sure why it's happening, because the Link is pointing to '/' in its to prop.

https://github.com/MyEtherWallet/MyEtherWallet/blob/7fd7ba66c9b13879c6acf7c4074452eb09b291e6/common/components/Header/index.jsx#L34-L35

Perhaps it happens during build somehow?

The result is that I'm running an app locally in "offline" mode but can accidentally switch into "online" mode without realizing it just by clicking on the header image with the intention of simply going back to the home screen.

Re-render translations on language change

Right now our translations happen outside of the react ecosystem. Because of that, components that don't receive anything language related as a prop or implement componentShouldUpdate don't re-render upon changing languge. There are a few ways we could get around this:

1. Refresh the page on changing language. Not ideal UX, but this would also open us up to not sending all languages in the main JS build, slimming it down by a bit. You would only load the language you use.
2. Use something like https://github.com/gaearon/react-deep-force-update to force all components to re-render, even if they don't use translation, whenever the language changes. A little dirty, but would allow us to keep all other code exactly the same.
3. Create a connected <Translation> component, and use that instead.
4. Find an existing solution for localization, like react-intl.

Let me know what you think is best!

ENS caching

We should cache at least tld -> registrar mapping in local storage for defined ttl.

Address Derivation Tests

What?

As an MVP, a utility program will be created to provide V3 level coverage for address derivation tests in V4. In the future, additional tests should be incorporated from the above sources.

Docker image for privToAddr

Background

Ethereumjs-util previously contained a bug that would incorrectly derive addresses from privateKeys with a 1/128 probably of occurring. Taylor provides a summary of the event here

As a reactionary measure, V3 of MEW contains an ad-hoc (run whenever you want to test it) derivation test, however it does not use multiple privToAddr implementations.

While MEW V3 contains a Wallet Generation Test, test coverage could be improved by incorporating tests from the following sources:

1. Go-Ethereum
2. Go-Ethereum
3. Parity
4. Ethereum/Tests

Bundle images with webpack

Wallet Decrypt

Requirements

• 1. Keystore
• 1b. Presale JSON
• 2. Raw private key
• 2b. Deprecated Encrypted Private Key
• 3. Bip39 Mnemonic with custom path / any number of words / password
• 5. Ledger
• 6. Trezor
• 7. Address only (will be used on view wallet and send page for offline?)

Future (Low Priority)

"Is having the wallet info disappear on each tab-change a feature? Would it be better if it persisted between tabs? (The only implication I can think of is how would a user "sign out" of their wallet so they could choose another one.)"

• 5 minutes -> show warning that their wallet is unlocked in the top tabby-guy (meta title tag)
• 30 minutes of no interaction -> lock wallet, force user to unlock again
• If user wants to use a different wallet, tell them to refresh the freaking page?
• I'll make a little wallet icon with a cross through it or something that they can click to clear the current wallet from the current state and show the decrypt panel again
• Keepkey Hardware Wallet
• Improve UX of decryption of keys with high n values kvhnuke/etherwallet: Issue #486
• Hitting enter should unlock wallet

Github Ref

1. Make sure to strip beginning 0x from raw private keys: MyEtherWallet/etherwallet#400
2. Allow Metamask users to use metamask + mew? MyEtherWallet/etherwallet#238
3. High n values in keystores -> frozen browser MyEtherWallet/etherwallet#43

"Window Blocked" error

This error has come up with a number of users using Hardware Wallets on contract functions. Upon search for this issue online, I found that the first occurrence of this error I could find online was around June 14th here. There's only a few people who have complained about it, and doesn't seem to have ever been solved. Additionally, it appears to be isolated to MEW, despite my conclusion that because this error message doesn't exist in the repo, it must be coming via RPC.

Any ideas what this is related to?

Import Updated Styles from V3

• adjust components to respect new styles

Error when building app

Node: 8.2.1
NPM: 5.3.0
Yarn: 0.27.5

Command: npm run build

Error:

1 verbose cli [ 'C:\\Program Files\\nodejs\\node.exe',
1 verbose cli   'C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npm-cli.js',
1 verbose cli   'run',
1 verbose cli   'build' ]
2 info using [email protected]
3 info using [email protected]
4 verbose run-script [ 'prebuild', 'build', 'postbuild' ]
5 info lifecycle [email protected]~prebuild: [email protected]
6 verbose lifecycle [email protected]~prebuild: unsafe-perm in lifecycle true
7 verbose lifecycle [email protected]~prebuild: PATH: C:\Program Files\nodejs\node_modules\npm\bin\node-gyp-bin;D:\Documenten\GitHub\MyEtherWallet\node_modules\.bin;C:\Python27\;C:\Python27\Scripts;C:\Program Files\nodejs\;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;D:\Programma's\Mingw\mingw32\bin;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\lib32;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\include;D:\Programma's\Cmake\bin;C:\Program Files (x86)\Skype\Phone\;C:\Users\Luit\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\Git\cmd;D:\Downloads\php-7.1.3-nts-Win32-VC14-x86;C:\ProgramData\ComposerSetup\bin;C:\Program Files\cURL\bin;C:\Go\bin;C:\Program Files (x86)\curl;C:\Ruby23\bin;C:\Users\Luit\AppData\Local\Microsoft\WindowsApps;C:\Users\Luit\AppData\Local\atom\bin;C:\Users\Luit\AppData\Local\Android\android-sdk\tools;C:\Users\Luit\AppData\Local\Android\android-sdk\platform-too;C:\Program Files (x86)\Yarn\bin;C:\Program Files\nodejs\;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;D:\Programma's\Mingw\mingw32\bin;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\lib32;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\include;D:\Programma's\Cmake\bin;C:\Program Files (x86)\Skype\Phone\;C:\Users\Luit\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\Git\cmd;D:\Downloads\php-7.1.3-nts-Win32-VC14-x86;C:\ProgramData\ComposerSetup\bin;C:\Program Files\cURL\bin;C:\Go\bin;C:\Program Files (x86)\curl;C:\Ruby23\bin;C:\Users\Luit\AppData\Local\Microsoft\WindowsApps;C:\Users\Luit\AppData\Local\atom\bin;C:\Users\Luit\AppData\Local\Android\android-sdk\tools;C:\Users\Luit\AppData\Local\Android\android-sdk\platform-too;C:\Users\Luit\AppData\Local\Yarn\bin
8 verbose lifecycle [email protected]~prebuild: CWD: D:\Documenten\GitHub\MyEtherWallet
9 silly lifecycle [email protected]~prebuild: Args: [ '/d /s /c', 'check-node-version --package' ]
10 silly lifecycle [email protected]~prebuild: Returned: code: 0  signal: null
11 info lifecycle [email protected]~build: [email protected]
12 verbose lifecycle [email protected]~build: unsafe-perm in lifecycle true
13 verbose lifecycle [email protected]~build: PATH: C:\Program Files\nodejs\node_modules\npm\bin\node-gyp-bin;D:\Documenten\GitHub\MyEtherWallet\node_modules\.bin;C:\Python27\;C:\Python27\Scripts;C:\Program Files\nodejs\;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;D:\Programma's\Mingw\mingw32\bin;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\lib32;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\include;D:\Programma's\Cmake\bin;C:\Program Files (x86)\Skype\Phone\;C:\Users\Luit\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\Git\cmd;D:\Downloads\php-7.1.3-nts-Win32-VC14-x86;C:\ProgramData\ComposerSetup\bin;C:\Program Files\cURL\bin;C:\Go\bin;C:\Program Files (x86)\curl;C:\Ruby23\bin;C:\Users\Luit\AppData\Local\Microsoft\WindowsApps;C:\Users\Luit\AppData\Local\atom\bin;C:\Users\Luit\AppData\Local\Android\android-sdk\tools;C:\Users\Luit\AppData\Local\Android\android-sdk\platform-too;C:\Program Files (x86)\Yarn\bin;C:\Program Files\nodejs\;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;D:\Programma's\Mingw\mingw32\bin;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\lib32;D:\Programma's\Mingw\mingw32\i686-w64-mingw32\include;D:\Programma's\Cmake\bin;C:\Program Files (x86)\Skype\Phone\;C:\Users\Luit\.dnx\bin;C:\Program Files\Microsoft DNX\Dnvm\;C:\Program Files (x86)\Windows Kits\8.1\Windows Performance Toolkit\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\Git\cmd;D:\Downloads\php-7.1.3-nts-Win32-VC14-x86;C:\ProgramData\ComposerSetup\bin;C:\Program Files\cURL\bin;C:\Go\bin;C:\Program Files (x86)\curl;C:\Ruby23\bin;C:\Users\Luit\AppData\Local\Microsoft\WindowsApps;C:\Users\Luit\AppData\Local\atom\bin;C:\Users\Luit\AppData\Local\Android\android-sdk\tools;C:\Users\Luit\AppData\Local\Android\android-sdk\platform-too;C:\Users\Luit\AppData\Local\Yarn\bin
14 verbose lifecycle [email protected]~build: CWD: D:\Documenten\GitHub\MyEtherWallet
15 silly lifecycle [email protected]~build: Args: [ '/d /s /c',
15 silly lifecycle   'webpack --config webpack_config/webpack.prod.js' ]
16 silly lifecycle [email protected]~build: Returned: code: 2  signal: null
17 info lifecycle [email protected]~build: Failed to exec build script
18 verbose stack Error: [email protected] build: `webpack --config webpack_config/webpack.prod.js`
18 verbose stack Exit status 2
18 verbose stack     at EventEmitter.<anonymous> (C:\Program Files\nodejs\node_modules\npm\lib\utils\lifecycle.js:289:16)
18 verbose stack     at emitTwo (events.js:125:13)
18 verbose stack     at EventEmitter.emit (events.js:213:7)
18 verbose stack     at ChildProcess.<anonymous> (C:\Program Files\nodejs\node_modules\npm\lib\utils\spawn.js:40:14)
18 verbose stack     at emitTwo (events.js:125:13)
18 verbose stack     at ChildProcess.emit (events.js:213:7)
18 verbose stack     at maybeClose (internal/child_process.js:921:16)
18 verbose stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:211:5)
19 verbose pkgid [email protected]
20 verbose cwd D:\Documenten\GitHub\MyEtherWallet
21 verbose Windows_NT 10.0.14393
22 verbose argv "C:\\Program Files\\nodejs\\node.exe" "C:\\Program Files\\nodejs\\node_modules\\npm\\bin\\npm-cli.js" "run" "build"
23 verbose node v8.2.1
24 verbose npm  v5.3.0
25 error code ELIFECYCLE
26 error errno 2
27 error [email protected] build: `webpack --config webpack_config/webpack.prod.js`
27 error Exit status 2
28 error Failed at the [email protected] build script.
28 error This is probably not a problem with npm. There is likely additional logging output above.
29 verbose exit [ 2, true ]

Rename "Node Switcher" and "nodes" and stuff to be "Network" / "Network Selector"

Nodes no longer makes sense. Best have things consistent and correct earlier rather than later.

Sign and Verify

• Sign Message
• Verify Message
• Disable decrypt options that don't offer sign functionality.

Future:

• Sign via Ledger
  - [ ] Sign via Trezor (Trezor API not currently available)

can we add a node for MUSIC?

it's fairly a coming coin, same as EXPanse.
having the ability for users to generate wallets for these coins will help.

they are legit ethereum forks and the concept/idea is nice. give them support!

Translation infra

1. Move translation calls to babel transform
2. Extract translation ids when bundling
3. Add UI for lang.json editing

Confirmation Modal

Send TX Confirmation Modal should display:

• Warning: You are about to....
• [ Address ] + [ AddressIcon from ] -> [ Value ] [ CoinType ] -> [ Address ] + [ AddressIcon ] to
• The [ ETH ] node you are sending through is provided by [ MyEtherWallet ].
• Address From:
• Address To:
• Value:
• CoinType:
• Gas Limit:
• Gas Price:
• Nonce:
• Data:
• Chain ID:
• [Unsigned TX Textarea]
• [Signed TX Textarea]
• Cancel Button
• Yes, I'm sure Button

Future:

Current issues with current conf modals

1. People dont read them (had someone the other day literally tell me we need a confirmation for the confirmation....)

2. Too easy to miss the coin you are sending (e.g. ETH vs SNT)

3. Too easy to miss the chain you are on (ETC vs ETH), although the border I added has helped reduce those

4. Not the information the user wants / needs in an easily parsable / skimmible thing (table format will help)

Misc notes from Taylor:

"Separately, I hate how modals sometimes close all by themselves sometimes if you click twice or click outside. I do it on Twitter all the time and I think it's worse with bootstrap v4. I lose tweets ALL THE TIME when I'm trying to highlight something.

It shouldn't close unless you hit the X or the CANCEL button or hit the esc button (optional)

--

Other than that, I really like the success / error state inside the modal itself, but we'll have to decide how to handle alerts and things. While some successes and errors come from front-end validation, some are message returned directly from the node (e.g. a TX with that hash has already been imported). It would be safer to handle all alerts via the alerts handler, avoiding a potential situation where you sometimes show alert, sometimes put alert in modal, and if you aren't careful, accidentally don't show the alert at all. Making things fail-proof for our future selves is very important so we can build quickly with less worry. 😉"

Send + infra

Blockers

• To Address MyEtherWallet/MyEtherWallet#93
• node switcher MyEtherWallet/MyEtherWallet#89
• modals MyEtherWallet/MyEtherWallet#85

Send infra

• Query balances
• BalanceDrtv
• Estimate gas
• Sign tx
• resolve ens
• nonce/balance refresh
• broadcast tx
• "Add custom token" should support ENS names in the address field
• Amount
• ETH vs Tokens
• Gas Limit
• Gas Price
• Nonce
• Data ((n/a for tokens))
• "Send Entire Balance" - Calculates total balance - gas price and auto fills in amount (n/a for tokens)
• Increase nonce by 1 manually after they send a transaction (not sure if still necessary?)

Token Sale Infra

• Array / Object that allows us to set a pre-defined gas limit, data, and display message if a user enters a specific address

Validations

• Amount they are sending is positive number
• Amount they are sending is < current balance
• Data is valid hex
• Gas price is positive number
• (Low Priority) Show estimated TX fee in ETH?
• Contract wouldn't throw error (via estimate gas)
• If estimated gas > 4M, set gas to -1 and show error "This contract would use all available gas which means the contract is going to throw an error." or something. There should be an error there

URI

• Accept URI parameters to fill in fields
• Show message if URI is present

[Future-Proof] By default, new networks should have hardware wallets disabled

By default, new networks should have hardware wallets disabled until the creator of the network or the hardware wallet confirms the correct path / that it's good to go.

Apparently there are some unforeseen issues with non-Ethereum networks (musicoin) and hardware wallets that don't make sense to be, but let's be sure to fail safe.

edit after more info:

1. No non-EIP-155 chains should ever be added

2. Sign off required from network creator + hardware wallet (Ledger / TREZOR / Digital Bitbox) before merging.

3. By default, any new networks do not have hardware support

4. Figure out what the fuck path for the network. If not clear / officially in BIP44, do not merge.

Sidebar

This is the sidebar that shows up on on Send and a few other pages. It should probably be its own container, to keep it pretty autonomous (Instead of a component that purely receives props.)

• Account Address
• Account Balance (ETH)
• Token Balances
• Transaction History (links ATM)
• Equivalent Values
• Equivalent Values - Tokens
• Donate Button

Lock node module versions

Figure out if npm5 or yarn is the way to go, but we need to lock those puppies down.

Rainbow Node Dropdown

• Support rainbow coloring similar to V3 for node dropdown component.

build error on darwin (webpack.prod.js)

Hi,
I got an error on compiling on my mac .
Tell the author that this fails on your system:
npm ERR! webpack --config webpack_config/webpack.prod.js

---

0 info it worked if it ends with ok
1 verbose cli [ '/usr/local/bin/node', '/usr/local/bin/npm', 'run', 'build' ]
2 info using [email protected]
3 info using [email protected]
4 verbose run-script [ 'prebuild', 'build', 'postbuild' ]
5 info lifecycle [email protected]prebuild: [email protected]
6 silly lifecycle [email protected]prebuild: no script for prebuild, continuing
7 info lifecycle [email protected]build: [email protected]
8 verbose lifecycle [email protected]build: unsafe-perm in lifecycle true
9 verbose lifecycle [email protected]build: PATH: /usr/local/lib/node_modules/npm/bin/node-gyp-bin:/Users/Zwilla/IdeaProjects/MyEtherWallet-889765b89d58d130bad22ca4e0a9e58cd886eadb/node_modules/.bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/usr/local/go/bin:/usr/local/MacGPG2/bin:/Library/TeX/texbin
10 verbose lifecycle [email protected]build: CWD: /Users/Zwilla/IdeaProjects/MyEtherWallet-889765b89d58d130bad22ca4e0a9e58cd886eadb
11 silly lifecycle [email protected]build: Args: [ '-c', 'webpack --config webpack_config/webpack.prod.js' ]
12 silly lifecycle [email protected]build: Returned: code: 2 signal: null
13 info lifecycle [email protected]~build: Failed to exec build script
14 verbose stack Error: [email protected] build: webpack --config webpack_config/webpack.prod.js
14 verbose stack Exit status 2
14 verbose stack at EventEmitter. (/usr/local/lib/node_modules/npm/lib/utils/lifecycle.js:255:16)
14 verbose stack at emitTwo (events.js:106:13)
14 verbose stack at EventEmitter.emit (events.js:191:7)
14 verbose stack at ChildProcess. (/usr/local/lib/node_modules/npm/lib/utils/spawn.js:40:14)
14 verbose stack at emitTwo (events.js:106:13)
14 verbose stack at ChildProcess.emit (events.js:191:7)
14 verbose stack at maybeClose (internal/child_process.js:886:16)
14 verbose stack at Process.ChildProcess._handle.onexit (internal/child_process.js:226:5)
15 verbose pkgid [email protected]
16 verbose cwd /Users/Zwilla/IdeaProjects/MyEtherWallet-889765b89d58d130bad22ca4e0a9e58cd886eadb
17 error Darwin 16.6.0
18 error argv "/usr/local/bin/node" "/usr/local/bin/npm" "run" "build"
19 error node v6.10.3
20 error npm v3.10.10
21 error code ELIFECYCLE
22 error [email protected] build: webpack --config webpack_config/webpack.prod.js
22 error Exit status 2
23 error Failed at the [email protected] build script 'webpack --config webpack_config/webpack.prod.js'.
23 error Make sure you have the latest version of node.js and npm installed.
23 error If you do, this is most likely a problem with the MyEtherWallet package,
23 error not with npm itself.
23 error Tell the author that this fails on your system:
23 error webpack --config webpack_config/webpack.prod.js
23 error You can get information on how to open an issue for this project with:
23 error npm bugs MyEtherWallet
23 error Or if that isn't available, you can get their info via:
23 error npm owner ls MyEtherWallet
23 error There is likely additional logging output above.
24 verbose exit [ 1, true ]

Redux Test Suite Expansion

Tokens

• Default Tokens List
• Show Token Balances
• Add Custom ERC-20 Token (local storage)
• Remove Custom ERC-20 Token
• Relative to node they are on

[BLOCKED] Full ENS

• Start Auction
• Place Bid
• Start & Place Bid
• Reveal Bid
• Finalize Auction
• Resolve using Public Resolver

Available

• ETH
• ETC (future)
• Ropsten
• Rinkeby

Future (Low Priority)

• Is there a way to know if I have already revealed my bid for a certain name?
• Allow people to reveal via a JSON from the official client

Github Ref

1. Issue: Testnet ENS addresses MyEtherWallet/etherwallet#509
2. Issue: non-ascii characters? MyEtherWallet/etherwallet#480
3. Feature: Calendar MyEtherWallet/etherwallet#456
4. Show Address they are sending to: MyEtherWallet/etherwallet#454
5. Issue: Time MyEtherWallet/etherwallet#453

Help View

Node Switcher

• ETH Nodes
• ETC Nodes
• Ropsten
• Kovan
• Rinkeby
• Custom Node
• Current Node Saved to Local Storage
• Custom Nodes Saved to Local Storage
• Basic Auth user/pw?
• Node determines Chain ID

Github Ref

1. Issue: Kovan / Rinkeby Custom Nodes kvhnuke/etherwallet: Issue #495
2. Initial Feature: kvhnuke/etherwallet: Issue #61

Help prevent phishing / spamming in MEW Slack

Per Twitter discussion, let's use this thread to talk about solutions to help manage free community Slacks.

Slack has a full API and a 3rd party tool could get built that helps with management.

Handle Javascript Disabled

Right now the site just renders its broken state without Javascript. We should show a message about enabling it.

Likewise, we'll probably want to make a page that tells people to upgrade. We should settle on what features a browser NEEDS to run MEW.

Wallet Class Structure

Hey everyone!

Let's use this issue to determine our class structure for the different wallet types we support. I've piggybacked on what's currently in our codebase and divised a simple structure that I hope will be a good starting point for discussion:

BaseWallet
|   getAddress()
|   getNakedAddress()   
|
|__ PrivkeyWallet( privkey )
|   |   privKey
|   |   pubKey
|   |   address
|   |   generate()
|   |   getPrivateKey()
|   |   getAddress()
|   |   toKeystoreFile()
|   |   signRawTransaction()
|   |   signMessage()
|   |        
|   |__ EncryptedPrivkeyWallet( key, pass )
|   |       super( decryptPrivateKey( key, pass ) )
|   |
|   |__ MnemonicWallet( phrase, pass )
|   |       super( decryptMnemonicPhraseToPrivkey( phrase, pass ) )
|   |
|   |__ KeystoreWallet( keystore, pass )
|   |       super( decryptKeystoreToPrivkey( keystore, pass ) )
|   |
|   |__ PresaleWallet( presale, pass )
|           super( decryptPresaleToPrivkey( presale, pass ) ) 
|
|__ LedgerWallet
|       address
|       signRawTransaction()
|       signMessage()
|
|__ TrezorWallet
        address
        signRawTransaction()
        signMessage()

To summarize, all wallets inherit from BaseWallet and any wallet dependent on deriving a private key (EncryptedPrivkeyWallet, KeystoreWallet, PresaleWallet, MnemonicWallet) is essentially a wrapper for PrivkeyWallet. All wallets should come equipped with methods to sign transactions and messages (signRawTransaction() & signMessage(), respectively).

Additional work will probably have to go into LedgerWallet and TrezorWallet, specifically dealing with HD key paths & verifying addresses exist.

Please let me know what y'all think 😄

@dternyak @crptm @wbobeirne

View with Address Only

• Show Address
• Show Balances
• Print Paper Wallet

Github Ref

1. Feature: kvhnuke/etherwallet: Issue #507 Bookmarkable / refreshable page
2. Feature: Printable mnemonics if they unlock via mnemonic kvhnuke/etherwallet: Issue #493

Remove PropTypes in Production Build

Possibly via babel-plugin-transform-react-remove-prop-types

Change "Raw Tx" To "Unsigned Tx" on send page

per @tayvano's request.

Balance Component

• ETH Balance
• Token Balances
• User's address + addressicon
• Donation Blurb on Send Page
• Equivalent values in USD CHF BTC EUR GBP
• Equivalent values for Tokens
• Equivalent values for all balances (ether + tokens)

Github Ref

1. Better ethplorer integration? kvhnuke/etherwallet: Issue #431
2. GBP kvhnuke/etherwallet: Issue #440
3. Equiv of tokens kvhnuke/etherwallet: Issue #435

Move to BN.js

We already have it as dependency. It can into parsing/writing base16 values.

• It does not support decimals so we need some helpers for that
• we need flow definitions

Confirm tx modal

Okay so I put this somewhere but basically for the confirmation modals it should always parse the signed TX and display:

• From address + addressicon
• Amount
• Coin Type
• To address + addressicon
• Gas Limit
• Gas Price
• TX Fee in ETH + USD (USD situation is optional for now)
• Data
• Title / Message (e.g. "You are about to send a transaction" or "you are about to resolve your ENS name" or whatever is passed to it)
• Current chain (ETH vs ETC)
• Who node is provided by

I think what you've built here is great for that and love the table.

This gives us a really reusable modal and acts as a final check for the user. One of the things I really don't like is, for example, the current contract page modal doesn't give you anything. No address, no idea how much its going to cost to deploy, etc.

---

Current issues with current conf modals

• People dont read them (had someone the other day literally tell me we need a confirmation for the confirmation....)

• Too easy to miss the coin you are sending (e.g. ETH vs SNT)

• Too easy to miss the chain you are on (ETC vs ETH), although the border I added has helped reduce those

• Not the information the user wants / needs in an easily parsable / skimmible thing (table format will help)

---

Separately, I hate how modals sometimes close all by themselves sometimes if you click twice or click outside. I do it on Twitter all the time and I think it's worse with bootstrap v4. I lose tweets ALL THE TIME when I'm trying to highlight something.

It shouldn't close unless you hit the X or the CANCEL button or hit the esc button (optional)

--

Other than that, I really like the success / error state inside the modal itself, but we'll have to decide how to handle alerts and things. While some successes and errors come from front-end validation, some are message returned directly from the node (e.g. a TX with that hash has already been imported). It would be safer to handle all alerts via the alerts handler, avoiding a potential situation where you sometimes show alert, sometimes put alert in modal, and if you aren't careful, accidentally don't show the alert at all. Making things fail-proof for our future selves is very important so we can build quickly with less worry. 😉

Warn of darklisted domains

Using ethereum-lists, would it be part of MEWs vision to show an alert if you're sending funds to a darklisted address?

Perhaps inform the user with a red error box above the button to finalise sending funds.

(E)NS resolving support

• 1. match all foo.tld addresses
• 2. resolve label to address on resolver

---

• We should debounce 1.
• We can cache 2 bw browser refreshes.
• Use ens abi to interact with contracts.

Bonus points for:

• readable errors
• extension point(s) to integrate non-ens resolving

Swap

General

• Ensure that V4 implementation matches feature parity with V3
• Add Emoji in Navbar
• Show coin as disabled instead of hiding when unavailable

Bity

• ETH - > BTC
• BTC -> ETH
• ETH -> REP
• BTC -> REP

Shapeshift

• ETH Tokens -> ETH
• ETH -> ETH Tokens
• ETH -> Other coins

Validations

• User is only allowed to send ETH if they have more ETH in the account they unlock than the swap they started
• User is only allowed to send up to...
  • BTC: Min: 0.01, Max: 3
  • ETH: Derived from BTC
  • REP: Derived from BTC
• countdown stops at 0:00
• Message: Time has run out.
  If you have already sent, please wait 1 hour.
  If your order has not be processed after 1 hour,
  please press the orange 'Issue with your Swap?' button. appears when:
  • Order cancelled
  • Time has run out.
• Support Request Button
• QR Code for BTC send
• address important todo in codebase about checking status in order status poll when order is not expired

Future

Bity

• ETH / BTC -> EUR
• ETH / BTC -> CHF

Coinbase

• USD -> ETH

ShapeShift

• Other Coins -> ETH (lower priority)

Generate Wallet creates empty File

A regression in the generate wallet flow is causing files to be downloaded as empty objects.

To Address Component

• Resolves ENS name to address
• Shows Addressicon

Validations

• Validates Valid Ethereum Address w/ Checksum if Available
• Validates valid ENS name
• Not sending to 0x00000
• If ENS resolver is set to 0x0, don't show as resolved to an address

Get HMR working

Right now any change to a component forces a reload from HMR, apparently not knowing how to update. Looks like we're on react-hot-loader v3 (beta) which says that the hot loading API is no longer handled automatically, and that we need to manually hook it up: https://github.com/gaearon/react-hot-loader/tree/master/docs#migration-to-30. See the notes about <AppContainer/> and module.hot.accept.

I was unable to get this working by specifically specifying dependencies in common/index.js, i.e.

if (module.hot) {
+  module.hot.accept('components', () => renderRoot(Root));

  module.hot.accept('reducers/index', () =>
    store.replaceReducer(require('reducers/index').default)
  );
}

however I was able to get it working by simply doing a blanket accept, and letting <AppContainer/> do its thing. However, this seemed potentially dangerous, as I don't really know what this is doing WRT the redux store or component state:

if (module.hot) {
+  module.hot.accept();

  module.hot.accept('reducers/index', () =>
    store.replaceReducer(require('reducers/index').default)
  );
}

Gas Price Component

• Implement Gas Price Component
• Save selection to local storage.

Future:

• Gas Price config changes redux state on any slider change. We only need to persist the last change within n amount of time. lodash/throttle may be helpful

Hardware / Mnemonic wallet modal proposal

As someone relatively new to crypto, I was a little confused about the current hardware wallet modal. Specifically the concept of derivation paths. The current modal, for reference:

I had the following questions when I first saw this:

• What is a derivation path?
• Do I need to change this?
• The one I selected mentions Jaxx, Metamask etc. Is that OK?
• What happens when I click "More addresses"? How many are on here? Can I go back?

After working on Trezor for a bit, I've realized that a lot of this stems from the re-use of the same modal for mneumonic wallets. I think it would be smart to keep that re-use, but tailor the modal for each hardware wallet via component props and make this a little simpler.

I put together some wireframes (These are NOT designs, just wireframes) of what I think would keep it simpler, without sacrificing the abilities offered from the current one. I'm not sure I captured every state needed, but this should be enough to go off of when we implement this.

select-address.pdf

I'm still a little hazy on the derivation paths and BIP44, so please let me know if I lost anything in this simplification. CC @dternyak @crptm @skubakdj @tayvano for feedback.

Changing node resets coin type

When I fill a transaction form and change the token from ETH to another, this setting is reset when I change the node in the upper right pull down field. All other form fields keep their value. This can be tricky, because then you are sending another type of coin then expected.

Strip Redux DevTools in Prod

Error when running app in dev mode

Node: 8.2.1
NPM: 5.3.0
Yarn: 0.27.5

Command: npm run dev

Error:

    at devMiddleWare.waitUntilValid (D:\Documenten\GitHub\MyEtherWallet\webpack_config\server.js:58:22)
    at Object.ready (D:\Documenten\GitHub\MyEtherWallet\node_modules\webpack-dev-middleware\lib\Shared.js:159:29)
    at Function.waitUntilValid (D:\Documenten\GitHub\MyEtherWallet\node_modules\webpack-dev-middleware\lib\Shared.js:206:10)
    at app.get (D:\Documenten\GitHub\MyEtherWallet\webpack_config\server.js:57:17)
    at Layer.handle [as handle_request] (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\layer.js:95:5)
    at next (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\route.js:137:13)
    at Route.dispatch (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\route.js:112:3)
    at Layer.handle [as handle_request] (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\layer.js:95:5)
    at D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:281:22
    at param (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:354:14)
    at param (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:365:14)
    at Function.process_params (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:410:3)
    at next (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:275:10)
    at middleware (D:\Documenten\GitHub\MyEtherWallet\node_modules\webpack-hot-middleware\middleware.js:26:48)
    at Layer.handle [as handle_request] (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\layer.js:95:5)
    at trim_prefix (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:317:13)
    at D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:284:7
    at Function.process_params (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:335:12)
    at next (D:\Documenten\GitHub\MyEtherWallet\node_modules\express\lib\router\index.js:275:10)
    at goNext (D:\Documenten\GitHub\MyEtherWallet\node_modules\webpack-dev-middleware\middleware.js:27:49)
    at processRequest (D:\Documenten\GitHub\MyEtherWallet\node_modules\webpack-dev-middleware\middleware.js:58:21)```

Mnemonic Generation Support

Alongside raw private key and UTC wallet generation, it would be valuable for MEW to provide a mnemonic based wallet (potentially in the same format as MetaMask).

Misc Notes

• Metamask implementation
• BIP 32 - core
• BIP 39 - wordlist
• BIP 44 - paths

To create a binary seed from the mnemonic, we use the PBKDF2 function with a mnemonic sentence (in UTF-8 NFKD) used as the password and the string "mnemonic" + passphrase (again in UTF-8 NFKD) used as the salt. The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function. The length of the derived key is 512 bits (= 64 bytes).

So any passphrase you choose, gets concatenated with "mnemonic" and is used as a salt. ie. if your passphrase was "Th1sI5mYp@ssphr@se"... it would be "mnemonicTh1sI5mYp@ssphr@se" being used as the salt and an iteration count of 2048.

Also, as mentioned in the BIP, ANY passphrase provided will generate a valid seed... so an attacker would then need to check addresses for every generated/tested passphrase for coins further slowing down any attack.

-- BIP 39?

MEW does not provide options for hardware wallets when signing messages

Mew's compatibility with Trezor and Ledger Nano S wallets on the Send Tokens page makes it a very powerful webpage.

However, these options are not present on the Sign Message page.

I'd love to see MEW duplicate the existing hardware wallet functionality for signing messages as is already implemented for sending tokens.

Contracts

Requirements

• Deploy Contract
• Read Functions
• Write Functions

Future

1. Get ABI from Swarm
2. Get ABI from Etherscan
3. Save Addresses / ABIs to local storage
4. Query string -> Contracts?

Regarding Swarm
kvhnuke/etherwallet: Issue #298
Not sure if I understand you correctly, but you do not need to have a swarm node to retrieve that info, you can just use http://swarm-gateways.net. And this is also totally unrelated to the testnet. The testnet is currently being used as an incentive structure for swarm, but contracts compiled with the latest solidity version will always have the metadata hash embedded, no matter where you deploy them.
The main problem with kvhnuke/etherwallet: Issue #298 I see is that people have to publish the metadata (or at least store it somewhere and publish later) when deploying the contract.

Future
Dedicated Mutlisig Interface? ( kvhnuke/etherwallet: Issue #512 )

Github Ref
Feature: kvhnuke/etherwallet: Issue #514 support constructor arguments for contract deployment
Feature: kvhnuke/etherwallet: Issue #513 allow contract deployment via offline tx
Issue: janky contract UI: kvhnuke/etherwallet: Issue #469
Constructor: kvhnuke/etherwallet: Issue #397
Contract ABI - kvhnuke/etherwallet: Issue #317
Metadata retrieval kvhnuke/etherwallet: Issue #298
kvhnuke/etherwallet: Issue #240

Import Updated translations from V3

• import language files
• adjust components to respect new keys

Off by magnitude in sidebar

v3 sidebar:

v4 sidebar:

From this address: 0xbF1B0b4dAebb78b65e842716936d68F178d5e8D1