Terra Station UST/LUNA wallet web/desktop are not safe...

• station

  109 94 8.8 TypeScript

  🛰️ Station wallet

  

Hi everyone, just looked at the code/functions of station-desktop (https://github.com/terra-money/station-desktop/blob/d7b6b19635d3115bbe1c81483fdf841adf1ce2bc/public/electron.js) AND if you look at ipcMain.on('generateAddresses', async (event, seed) => { .. AND then you open up the "web" version that is used by the electron app itself (bcz "desktop wallet" is the same as using https://station.terra.money/) I was expecting to find ipcRenderer (or something..) to call generateAddresses here: https://github.com/terra-money/station. BUT SUPRISE... it's not even there... The open source web app is not requesting generateAddresses. SO... that means only https://station.terra.money/ is calling this function, AND it seems like https://station.terra.money/ is also providing the seed?! I know I might sound crazy and I might be totaly wrong bcz I never coded an Electron app, but after spending an hour, I'm more worried now that https://station.terra.money/ is able to provide the seed, knows your private keys and could store them for some time later to scam everyone out of their money... remember their website/wallet https://station.terra.money/ is not open-source so they can do anything with your data and money.. UNLESS you use their "open-source web wallet" (https://github.com/terra-money/station) which for some reason when running on localhost:3000 I CAN'T CREATE "New wallet". To create one I have to get the desktop app, which again doesn't have any f**cking istructions on how to build it from open-source. Yes it's hosted on github, but the app still uses https://station.terra.money/. SO it's not a true "open-source wallet". Coming from Ethereum and open-source "Metamask wallet - browser extension" that is simiple to build from soruce-code.. Terra Station and Terra/LUNA/UST itself seems like a scam.

• station-desktop

  4 27 5.7 JavaScript
  

Hi everyone, just looked at the code/functions of station-desktop (https://github.com/terra-money/station-desktop/blob/d7b6b19635d3115bbe1c81483fdf841adf1ce2bc/public/electron.js) AND if you look at ipcMain.on('generateAddresses', async (event, seed) => { .. AND then you open up the "web" version that is used by the electron app itself (bcz "desktop wallet" is the same as using https://station.terra.money/) I was expecting to find ipcRenderer (or something..) to call generateAddresses here: https://github.com/terra-money/station. BUT SUPRISE... it's not even there... The open source web app is not requesting generateAddresses. SO... that means only https://station.terra.money/ is calling this function, AND it seems like https://station.terra.money/ is also providing the seed?! I know I might sound crazy and I might be totaly wrong bcz I never coded an Electron app, but after spending an hour, I'm more worried now that https://station.terra.money/ is able to provide the seed, knows your private keys and could store them for some time later to scam everyone out of their money... remember their website/wallet https://station.terra.money/ is not open-source so they can do anything with your data and money.. UNLESS you use their "open-source web wallet" (https://github.com/terra-money/station) which for some reason when running on localhost:3000 I CAN'T CREATE "New wallet". To create one I have to get the desktop app, which again doesn't have any f**cking istructions on how to build it from open-source. Yes it's hosted on github, but the app still uses https://station.terra.money/. SO it's not a true "open-source wallet". Coming from Ethereum and open-source "Metamask wallet - browser extension" that is simiple to build from soruce-code.. Terra Station and Terra/LUNA/UST itself seems like a scam.

• SurveyJS

  surveyjs.io featured

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

Suggest a related project