blockchain / unused-my-wallet

Legacy Blockchain Web Wallet - current version is at https://github.com/blockchain/My-Wallet-V3-Frontend

My-Wallet

Source code for blockchain.info. Please contact support if you experience any issues as a user.

Setup

Make sure you have Node.js installed.

Install dependencies:

npm install -g grunt-cli
npm install

Create a file called .env in the root of the project. Put the following in it:

ROOT_URL=https://blockchain.info/

Build

Grunt watches and compiles the Javascript. Keep it running:

grunt

Run

Run local http server:

npm start

Visit local.blockchain.com:8080. Do not use localhost:8080. You will need to modify your "hosts" file (/etc/hosts on OSX and most UNIX systems) because this is no longer registered at the DNS level for application security reasons. Add this line to /etc/hosts:

127.0.0.1   local.blockchain.com

Contributing

Consider contributing to the new and improved wallet

Usage

You can open any wallet, but you can't create one (yet).

Security

Security issues can be reported to us in the following venues:

• Email: [email protected]
• Bug Bounty: https://www.crowdcurity.com/blockchain-info

unused-my-wallet's Issues

Error Pushing Transaction # (blockchain.info Wallet)

Usually wrong dollar value on Transaction Summary window.

1- I already reported this problem on forum but Piuk didn't reproduce. Quote from forum:
(Me: I still reproduce this problem: https://bitcointalk.org/index.php?topic=40264.msg1308240#msg1308240

Did you look it?
Piuk:
I can't reproduce this. The popup summary is shown in a frame so you may have to wait for it to load the new transaction.)

2- I tried Demo wallet and works ok
3- On my wallet I reproduce the problem.
4- Piuk: If you want I can temporarily change my wallet password, so you can reproduce the bug. (My Wallet only has 0.00070621 btc.

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

MySQL error "Lock wait timeout exceeded; try restarting transaction" when trying to view transaction history and balance on an address

For example, this error occurs on http://blockchain.info/address/1JiDbdmDvbbiNowB9eVnHRvn1Em5aEYzt6

This occurs for any address, by the way.

I have tried this on multiple IPs and on multiple browsers and I get the same error, so it definitely is server-side.

When I try to wget the URL on my VPS:

wget http://blockchain.info/address/1JiDbdmDvbbiNowB9eVnHRvn1Em5aEYzt6
--2013-04-15 09:10:56--  http://blockchain.info/address/1JiDbdmDvbbiNowB9eVnHRvn1Em5aEYzt6
Resolving blockchain.info (blockchain.info)... 141.101.112.196, 190.93.243.195, 2400:cb00:2048:1::be5d:f3c3, ...
Connecting to blockchain.info (blockchain.info)|141.101.112.196|:80... connected.
HTTP request sent, awaiting response... 500 Internal Server Error
2013-04-15 09:10:58 ERROR 500: Internal Server Error.

Screenshot of error:

BlockChain Has new bug with Country Code SMS

BlockChain Has new bug with Country Code SMS

"TypeError: MyWallet._seed is not a function" Error Seen When Trying To Sweep Archived Addresses

Some coins were sent to an archived address (archived a while back due to the possibility, however unlikely, of being compromised) recently and this error appears when I try to do a sweep of the address.

Everything up until this point works correctly:

1. Log-in and navigate to "Receive Money".
2. Click the "Archived" tab, select the "Bitcoin Address" checkbox as well as the checkbox of the address itself,
3. Click "Sweep Keys" and a secondary password is asked for (as per my settings).
4. After correctly entering the secondary password, it then gives me a choice of which active address I would like to sweep to and I select my personal address.
5. The error is then displayed and the sweep is halted.

Update: Sweep was successful using the Chrome Extension, Error seems to exist because of secondary password. The function from signer.js doesn't appear to be called correctly.

Allow P2SH transactions

Hi there,

Unfortunately P2SH addresses (starting with 3) are invalid in myWallet.
Could you implement P2SH into myWallet, please. Or at least allow spending coins into p2sh addresses? thanks

Regards
-- Fabian

Documentation update on the github repo

1. Readme file is missing
2. The repo description states "Collection of My Wallet Javascript files used for the javascript verifier (https://blockchain.info/wallet/verifier)". As I understand, this repo now contains much more, including some client & server code, as mentioned here: https://blockchain.info/wallet/security. This should be documented.

archived address's no longer showing balances

steps to reproduce:

log into a wallet
click 'receive money', click 'archived addresses' tab
all balances show zero

This is new, undesired behavior in the last 24 hours (Oct 20, 2013)

Import Wallet Plaintext JSON not working

Plaintext JSON import of new watch only addresses not working.

To reproduce:

1. "export unencrypted", copy JSON text
2. append ,{"addr":"1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T", "label":"chbs"} to keys array
3. paste into "import wallet" textarea, submit

Expected result: new address in wallet and Active addresses list.

Actual result: no change in wallet. Verified by reloading and re-visiting step 1 above.

Verified to-be-imported JSON was syntactically correct using $.parseJSON() via chrome console.

The webcam is not disabled after use

This is more a trust issue than a bug.

1. Open a QR-scanner in My Wallet (Not from any specific place in My Wallet. The bug is reproducible everywhere in My Wallet)
2. Scan a QR-code or just click cancel after allowing BlockChain.info to use the webcam.

Note that the small LED on the webcam is still turned on. The webcam will only be disconnected when the user leaves My Wallet.

This is an issue because users might think you are spying on them, which could scare some users enough to stop using your service.

Bounty: 1testKGQqBv6FQUWL3nY9cSEjGqFAuW2P

JSON RPC API sendmany not working for multiple outputs for same address

I've run the call with similar parameters to those in the example:
{"1yeTWjh876opYp6R5VRj8rzkLFPE4dP3Uw":10,"1yeTWjh876opYp6R5VRj8rzkLFPE4dP3Uw":15}

i.e. two outputs for the same recipient address, and the call only sends one.

I think it might have to do with the call converting the addressAmountPairs to a HashMap or something similar. Is it possible to get this behavior working?

/pushtx doesn't work properly

I am programmatically creating a transaction that spends the coins with OP_CHECKMULTISIG. The transaction my program generates appears to be fine — including the signature, there are as many valid signatures as scriptPubKey needs.

http://blockchain.info/pushtx, however, shows an "Invalid Signature" error even though the signature(s) are valid.

Pushing this same transaction via bitcoind's sendrawtransaction and through coinb.in works perfectly.

For the reference, here is transaction I wanted to spend: (539e17627b29b8ab596329fadb3ec3cb4cceb34554625c0e06dcf4b9e955555f)[https://blockchain.info/tx/539e17627b29b8ab596329fadb3ec3cb4cceb34554625c0e06dcf4b9e955555f]

And here is the transaction I tried to spend it with (failed via /pushtx, worked via coinb.in):

01000000015f5555e9b9f4dc060e5c625445b3ce4ccbc33edbfa296359abb8297b62179e5300000000930048304502204a0f1b7f29b737f2c5502dbaab4efc1197e7d4291c48d0cb6d37682f64035dfc0221008c2e65e0f23dd08df09225a4b67b35ae5d6a6f449df328d4bde51b64cd76432d01483045022100d011e1583fb10d6b8c08fbbf6de0076d77cd848fccdabb14c4ce2cc2d3f8e9fb022028d4bb3b877eed8656a7caaa84adc4c6da1bffa7dc9c591849071e830d362c5401ffffffff0180841e00000000001976a914da4d3e3cc134364d67a8d2ef80b3227242af302388ac00000000

It was relayed successfully when I pushed it via coinb.in: https://blockchain.info/tx/eb1d01bf611e77c2e756df5b60a5a5eb207e739fe1a15a06dd0a7b30c53bcbc0

So, why doesn't it play nicely with Blockchain?

My guess is, blockchain doesn't know about multisig transactions since regular pay-to-address transactions go through. It's just multisig transactions that don't.

Would really appreciate if you fixed this.

Satoshidice changed amount without asking

I entered a bet in satoshidice of 0.001 BTC, and mywallet reacted updating the "win amount" to 64 BTC.

I clicked "place bet", and the bet amount changed to 0.01 (the "win amount" changed accordingly to 640 BTC).

Problem is I was never prompted about this apparent minimum bet amount of 0.01, I just entered a lower number and when I placed a bet it did place a higher number without any confirmation.

Bitcoind-compatible JSON-RPC API - Amount of confirmations reported as a negative number

When I use the JSON-RPC command 'gettransactions', the amount of confirmations is reported incorrectly as a negative number. For example, when a transaction has 54821 confirmations, it is incorrectly shown as having -54821 confirmations:
["confirmations"]=> int(-54821)

This seems to happen regardless of the transaction type (whether it's received or sent).

Getting Unspent Outputs Crash

On-screen keyboard for second password does not have a 'space' key

Passwords can contain spaces, but you can't type a password with spaces using only the on-screen keyboard.

Block chain wallet, auto logout and 2 factor authentication

Let's say I am logged into my block chain wallet with 2 factor email authentication. If i am inactive for too long, the website automatically logs me out of my account. However, when I am logged out, I am taken to the homepage, which displays my identifier, a blank password field, and a blank email code field. Every few minutes when the webpage decides to automatically refresh itself, it will send me another email with my login code. If my computer is left on too long, it will keep spamming email codes and eventually I would be locked out of my account.

I am using windows 7-64 bit and google chrome.

(Demo Wallet) TypeError: 'undefined' is not an object

1- Login on Demo Wallet
2- Go to Account Settings
3- Go to Logging

You will see a popup error message: TypeError: 'undefined' is not an object

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

TypeError: 'undefined' is not an object

1- Go to Demo Wallet
2- Browse to my transactions tab
3- Go to page 10 on transactions tab.

Will appear a popup message with this error: TypeError: 'undefined' is not an object

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

Merchant API call sendmany not working for multiple outputs to the same address

This works using the web client, as I tested with this tx:
http://blockchain.info/tx/90367977

But when I tried it using the API, with the following recipients parameter (or something similar with other addresses):

{
"1AYEq2N1JEY1w8oRitmVmQb72hj7ZzdkR9": 10000000,
"1AYEq2N1JEY1w8oRitmVmQb72hj7ZzdkR9": 10000000,
"1AYEq2N1JEY1w8oRitmVmQb72hj7ZzdkR9": 10000000
}

The transaction only sent ONE output to the address, resulting in an incorrect behaviour. Can someone confirm this? Can or will this be fixed? Thanks

Wrong path in pay-now-button.js

url: root + './receive'

should actually be

url: root + './api/receive'

Reminder To Review Feedback

When the account is first created, the General account settings claims that
email two-factor authentication is enabled and that a confirmation will be sent
to {0} ... even though under Security, Two Factor Authentication is set to None
by default. (Changing the Security setting still does not change the General
message.) This makes me concerned that I will not be able to log in (because it
will expect an email confirmation code, which it cannot send).

Upon account creation, Firefox informs me that "This website (blockchain.info)
is asking to store data on your computer for offline use." Is this necessary for
your service to function? As a new user, I am concerned that if I decline, my
wallet will become lost. (Technically, I do not think this is the case, but it
gives pause to new users.)

Clarification regarding backups (sent via email or otherwise): Are they
encrypted with my passphrase? This should be made perfectly clear to new users.
The last thing I want is my private key being emailed (which should be
impossible since your servers don't even see it - right?).

Under Security, Never Remember Two Factor Login: "Check this if you want to
disable this behaviour and require full authentication every time. Enable /
Disable: []" Confusing... am I checking to disable not (never) remember
two-factor login?? Too many double negatives. Recommend: "Remember Two Factor
Login: Enable [x]"

Security, Restrict To IP: Another "Enable / Disable" conundrum. Also, as a new
user, I am concerned that if I enable this, then my IP changes, there will be no
recourse. This may very well be the case, but a quick sentence explaining would
be good (or explain if there is any way to overcome an IP lockout).

When clicking on "Logging" in the left menu, a red (warning/error?) message
states: "No backups found" ... which does not make sense. (Maybe should read "No
logs found" or should not show up at all here?)

Under Devices, scanning the code does nothing on my device. Is this code my My
Wallet reference number? Am I expected to already have the app installed on my
device? (The Android app crashes at startup on my Google Nexus 7, running
Android 4.2.1.)

Please understand that I'm a big fan of blockchain.info (I was just telling
someone yesterday that I think it's the best site on the Internet). These are
certainly not "complaints" - I hope that my input helps improve new user
experience. As you know, I'm a developer also and love Bitcoin, so I try to be
as helpful and constructive as possible in the community.

second password onscreen keyboard symbol &

When typing the '&' on the onscreen keyboard for the second password, five symbols are automatically typed instead of the one '&'.

Cant Disable Secondary Password

After Enabling Secondary Password, it cant be disabled anymore.

Steps to Reproduce the Problem:

1. Login into My Wallet > Passwords > Enable Secondary Password;
2. Type in the desired password and wait for the browser to finish the criptografic process;
3. Click the button to disable the secondary password;
4. The "canvas" shows a error message (red box) saying "Password must be 4 characters or more in length", but no box to type it (or modal) is shown.

If you logoff,login again and repeat the steps 1-3 (but for disabling the secondary password), the modal window with the virtual keyboard is now shown, but:

• if you type the WRONG secondary password, nothing happens (as expected);
• if you type the CORRECT secondary password, the password mnemonic frame is expanded (meaning that the password was received) but if you go and click the "disable secondary password" button again, the red error box is shown and nothing else happens;

Environment:

• Windows 7 Professional
• Firefox 18.0.1 - Everything javascript related enabled

Attached to this issue report is a screenshot showing the exact error:

Bounty: 1GQwoEwV6J7QNdgxQJV6do2Nmyd2NhbM6K

Logout problem on Demo Wallet

If you try to logout Demo Wallet clicking on top right button, you will be automatically logged in again.
I think when clicking on logout button, should be redirected to: https://blockchain.info/wallet/
But it's being redirected to: https://blockchain.info/wallet/demo-account

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

Import of Wallet Import Format Private Key does not check the checksum.

If I make an error entering a wallet import format private key I should be informaed that the checksum does not match.

Instead the checksum is ignored and and different private key is imported into the wallet.

This is very disconcerting when trying to redeem a paper wallet.

Wrong flag for Slovenian

The flag for Slovenian (sl.png) is wrong. Should be something like this:
https://www.google.com/search?q=slovenian+flag&hl=sl&safe=off&tbo=d&source=lnms&tbm=isch&sa=X&
(It should be similar to ru.png, with the coat of arms added.)

(This is minor, no bounty expected.)

Endless message display loops

Just opened the Pay By Pingit window, and 2 messages in pink repeatedly and continuously flash up, replacing each other at the top of the screen so they're unreadable. Can't quite make them out, but one is about Deposits not currently being available, and the other is about an Error downloading SMS codes.

Also got the same problem on the Sofort popup.

Using Chrome 25.0.1364.152 on OSX 10.8.2.

Rounding error with RPC API

I have a single satoshi in my blockchain wallet, but when I use the RPC API [1] and call 'getinfo' it shows my balance as 0.00000000, even though the documentation says it will round the value to 8 decimal places. Also, if I add more funds to the account, so the total is something like 0.05000001, getinfo rounds down to 0.05. Using the website or other site APIs (like q/addressbalance) show the single satoshi, so there is definitely a rounding bug with the RPC API.

[1] https://blockchain.info/api/json_rpc_api

Address book does not update

-Add new entry in the Address book window under Send Money of My Wallet
-List is updated new entry is shown.
-Remove entry using the red bin button
-"Wallet successfully synced with server" is displayed
-Entry is not removed from the view even when switching to different pages

When a new entry is added the view is updated (Only the new entry is shown)

It seems that an update of the view is missing when deleting entries from the Address book.

Bounty: 1CHYdLyXxw9qPPBR64uqcqaMSNsihVBKCQ

Two different mnemonics given at wallet creation with partial sequence similarity

When creating a new wallet, the small pop-up javascript box in the browser gave one mnemonic of 26 words which I dutifully copied down. I then selected "print," which popped up a new browser window with the paper wallet graphic, login link, mnemonic, and QR codes. However, this mnemonic differed. It was only 18 words.

Interestingly, the last 15 words of both mnemonics were identical; in the first mnemonic displayed during signup the first 11 words completely differed from the first 3 words of the mnemonic printed on the paper wallet sheet.

Browser: Chrome Version 30.0.1599.101 m on Windows 7.

Transactions do not work

Every transaction made from the website results in:

ReferenceError: Undefined variable: precisionFromBTC

Merchant API call address_balance not working for 0 confirmations

Could it be that the Merchant API is not reporting address balances when requested with 0 confirmations?

In the "Getting the balance of an address" call (https://blockchain.info/merchant/$guid/address_balance?password=$main_password&address=$address&confirmations=$confirmations)

when I use the parameter confirmations=0, the call returns a balance of 0 until the incoming transaction gets 1 confirmation.

The docs say: "$confirmations Minimum number of confirmations required. 0 for unconfirmed."
But I clearly get other behavior.

Wallet API List and New_Address are incompatible

In my application I generate addresses with New_Address API call, save them in my system, and then reference them after I call List to check for balance changes. However, New_Address returns uncompressed key format (so we for example get 1A3HtZXEy99oEGFGtoyhYEQVcqzn6Mckcf ), while addresses are saved on the server and returned by List as compressed keys (so suddenly the address turns to 143QUZYcbVZ2ELvxdZft52LRjLZRKNMTa6). Please be consistent in the addresses returned.

-

connections to rpc.blockchain.info time out

I haven't been able to connect to the blockchain RPC interface for a while now. Connections to rpc.blockchain.info just time out. And the web wallet and rest of blockchain.info site is up and running.

Got "Payment received" instead of "Payment sent" mail

Sent some bitcoins from my wallet, but instead of the usual "Payment sent" email, I got a "Payment received" one. It looks like it links to the right transaction, but is reporting the change (coming back into a different address in the same wallet) instead of the address I sent to. (The other target address was also a blockchain wallet, if that's helpful).

Can send more details if needed.

Import wallet.dat not working

Hi

Apologies if this is not the right place to report this, I wasn't 100% sure where to file it.

I'm trying to use the Bitcoin-QT importer at https://blockchain.info/wallet/import-wallet. (Side note: I had to google to find this, for some reason it's not listed on https://blockchain.info/wallet/login#import-wallet !)

Every time I drag a wallet file to it and enter the password, I either get the error "Captcha Code Incorrect" (which I assume is because I'm typing it incorrectly, although it happens so often I'm struggling to believe even I'm that bad at reading the captchas), or I get "Unexpected end of file from server".

I believe I'm typing my password correctly. Am I doing something wrong, or is this a bug in the importer?

I've tried using pywallet, but after finally getting it installed on my Mac, it just segfaults when I run it. The only other way I can see to import the wallet is to find and dump each private key in turn, unless I've missed one.

Thanks
Ash

Double-spend detected! popped up on a Quick Send transaction

As part of TX https://blockchain.info/tx/393dd87575226549f61d3b8e728d068bb242d02e4ecb842bffc86b3d9653c918

I was purchasing an issue of blink, and was using the standard Quick Send. When I hit send, it triggered the 'Double spend detected' warning popup, but then disappeared? or I went to another page, not quite sure. Looking at the transaction later of course shows 'no double spend detected.'

The inputs are kinda weird since they are identical from sdice, maybe that's it? Or could it be triggering from some some tests I was doing with Yuhfhrh's double-spend sdice method, but that was 4000 blocks ago...

I was definitely not trying to double spend the magazine, in fact it's my second copy...

Thanks!
kevin / paybitcoin

Importing a private key with webcam doesn't work

nor does it give any error message. I exported a private key into a QR code using the mycelium wallet android app and tried to import it into blockchain.info using import -"Scan with Webcam". It seems to parse the QR Code allright (a code appears in the input box), but when I press "Enter private key", nothing happens and I just get back to the menu.

Cannot log in.. keeps saying authorization required

Will not allow me to enter password, says I should check email .. no email received.

Firefox 22 under Ubuntu Linux 64 bit.

unable to log in with Chrome, IE9 ok

I found out that if I can log in the wallet with IE but not with Chrome. Wallet was opened using IE9. I tried copy paste from notepad and got the same thing:

IE9: ok
Chrome: Error decrypting wallet.

The error is repeatable.

Incorrect units on Miners Revenue Chart

Not quite My Wallet related but it is a blockchain.info bug

The Y-axis and tooltip on the Miners Revenue Chart (http://blockchain.info/charts/miners-revenue) is labeled as BTC however the description on the chart listing page (http://blockchain.info/charts) says that the graph should be showing the number of bitcoins and transaction fees multiplied by the market price.

The axis on the graph should rather be represented by USD or the description on the chart listing page updated.

12x9GZbeCzGqGxUihByNS36ULsLn392Det

Can't undo label address. (let blank)

1- On receive money tab, I labeled an address with name (Test)
2- I tried to undo the label (Test).

It's impossible to let the label blank. It's only possible change to another name. But not let blank.

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

connection in opera is not secure

When going to blockchain.info Opera says connection is insecure although it is https. Look at the images.

Br, Benjamin

Code review on WalletServlet.java

It should be refactored, it is a very long file, that contains some very long functions.

1. Break up any relevant classes to external instead of internal classes to help readability & maintainability (e.g. GoogleAuthenticator, DropBoxCacheEntry)
2. Break up any long functions to smaller functions/classes. Two prime example is doGet(), which is 678 lines long, and doPost() which is similarly long!
3. Seperate the data access functions into a dedicated DAL object/layer. Methods such as sendBitcoinsEmail() should not contain stuff like PreparedStatement, but rather use an external object that is responsible for this. I recommend an ORM, but it's not a must if you're not comfortable with it / don't want to introduce more dependencies.
4. Use a better logging mechanism than "System.out.println("Wallet POST GUID : " + guid + " is invalid " + method);". I suggest log4j or logback. In any case, I would make sure that errors are sent as emails to your inbox, so you can actually monitor & fix them.

My transactions tab only show 10 pages

1- Login on Demo Wallet
2- Go to My transactions tab
3- Browse to page 10, then click next.

Should show page 11, 12,...

Stop on number 10.

Bounty: 1DThFdzYNvVoTYe9zmJuhF8LZ6UeKuLBt7

Imported private key labels aren't used in the transaction list

I just merged an old (now defunct) Bitcoin-QT wallet into my Blockchain.info wallet, first by using the import wallet tool to generate a second Blockchain.info wallet with the same password as my main one, then by importing the Blockchain.info wallet backup from the intermediary wallet into my main one.

It has imported all the private keys and their labels, including the private keys for change addresses. There are two problems with the way it's displayed though.

First, change addresses are treated like other addresses, which adds a lot of noise to the transaction list. I don't know if this could be fixed though, presumably Bitcoin-QT keeps an internal record of which addresses are change addresses and this data hasn't been imported.

Second (and more important), transactions sent to labelled private keys don't show up in the transaction list as having being received to the receiving address (or its label), but from the addresses sending to it. I was hoping to be able to discard my Bitcoin-QT wallet and switch entirely to Blockchain.info, but for now I need to keep it as otherwise I can't easily tell my old received transactions apart.

The first point may be unsolvable, but would it be possible to improve the display of transactions sent to imported private keys?

Cancelled Transaction Immediately Goes Back Into Another Tansaction

I have a transaction in which I didn't include a miners fee and each time it gets cancelled due to it taking to long to be confirmed, it doesn't go back into my wallet, but another transaction.

TypeError in 'Sweep Keys'

Receive Money > Addresses > Archived Addresses

If I select 2 archived addresses, then press 'Sweep Keys', I receive the following error message:

TypeError: Cannot read property '1OneOfMyPublicKeysGoesHere' of undefined