-
Notifications
You must be signed in to change notification settings - Fork 20
Description
Describe the bug
The app simply lets in after 2 incorrect pin code entries. Yes, I'm not kidding and am as stunned as you can imagine.
To Reproduce
Steps to reproduce the behavior:
- Successfully set up some pin code in Settings => Security => Change PIN code. Say "1234"
- Kill the app
- Open it again, it asks for a pin
- Enter wrong pin like 0000. It will indicate that pin is incorrect
- Try again with the same wrong pin like 0000. After the 4-th digit something happens and you can delete or input anything else — it's brain-dead now and doesn't check the pin anymore. Wanna know why? Because you're already in!
- Press "back" (via system 3-button panel or a swipe if you use swipe controls, not via app keypad)
- Go back to the app again
- Welcome. You can see everything, you're in.
Expected behavior
Of course it shouldn't allow unlocking the wallet with the wrong pin! How did such a bug (?) slip in!? It should not let get beyond the pin screen ever, until the correct pin is entered, obviously.
Smartphone (please complete the following information):
- App version: latest v5.4.43 (APK version AND GPlay version)
- Devices: Pixel 4a and Realme 13+
- OS: Tested on 2 devices with Android 11 and 15 — same behavior
Additional context
I swear I'm not making this up, I re-rested this 10 times. This means that anyone can yoink the unlocked phone from my hands (or unlock it with my finger or whatever), and it doesn't matter that I set a different pin in Tonkeeper — 2 wrong pin tries and you can see all my TON wallet info: balance, NFTs and their details like what +888 TG number this NFT is connected to etc.
Granted, you cannot perform any operations (transfer or reveal seed phrase/wallet secret) as they DO in fact need a proper pin (thank God!), but you CAN change certain app settings like: disable fingerprint or lockscreen pin requirement! How did this get past QA?
This might also mean that the PIN entry screen is a thin veil placed over the info screen, which would be a terrible idea. App content screens should not init/draw while lock screen is present. Obviously.
Please, someone, ANYONE, test this on your devices and confirm — I can't be the only one with this issue.