Wallet Restoration via Seed Phrase Succeeds Using Repeated Single Word Input

[Ivanlomoljo26]

Wallet restoration via seed phrase proceeds even when using a single repeated word as input. However, it appears to generate a new wallet instead of importing the original one, as the previously associated address is not restored.
See the attached video.

0224.mp4

[Ivanlomoljo26]

Cc @WiktorStarczewski @0xnullifier

Summary

The onboarding import-from-seed flow validates only that each word appears in the BIP-39 English wordlist — it does not verify the BIP-39 checksum encoded in the last word of a real mnemonic. Because any 12 wordlist words clear this check, a user typing a repeated word (e.g. apple × 12) passes the "Continue" gate, and downstream key derivation (bip39.mnemonicToSeedSync → derivePath("m/44'/0'/…")) silently turns the bogus phrase into a deterministic PBKDF2 seed and fresh account. The user believes they're restoring their existing wallet; they're actually creating a brand-new one whose address has no relation to the original. The repo already contains the correct validateMnemonic pattern in a sibling component, but that component is dead code — the live flow regressed by dropping the check when the onboarding UI was rewritten (commit 4159cfeb, 2025-02-03).

Symptoms

Reproduced on main (commit 284e99e, wallet v1.14.2).

User-visible: any 12 words drawn from the BIP-39 English wordlist pass validation, the Continue button activates, onboarding completes normally, and the user lands on the home screen of a new wallet whose address does not match the one they tried to restore. There is no error distinguishing "invalid seed phrase" from "successful import" — no checksum check ever ran.

Persistence scope: every Import-from-seed attempt; reproducible on fresh install across Chrome / iOS / Android. The same gap also affects the ForgotPassword flow, which routes through the same submit action.

Reproduction steps

1. Fresh install of the wallet (extension or mobile). Launch, tap Import wallet → Seed phrase.
2. In the 12-word grid, type apple into every cell (or paste apple apple apple apple apple apple apple apple apple apple apple apple). Any other wordlist word works (banana, zebra, etc.).
3. The Continue button becomes enabled.
4. Tap Continue, set a password, tap through the confirmation screen.

• Expected: validation fails with an "invalid seed phrase" / checksum-mismatch error and the Continue button stays disabled — matching the BIP-39 spec and the existing behavior of the repo's other seed-phrase input component.
• Actual: onboarding completes and a fresh wallet is provisioned. Its address is deterministically derived from PBKDF2 of the garbage phrase and has no relationship to the user's original wallet.
• Reproduction rate: ~100% on any 12-word combination drawn from the BIP-39 English wordlist that doesn't coincidentally satisfy the checksum (which is ~1 in 16 — the checksum is 4 bits for a 12-word phrase).

Root cause (1 location)

src/screens/onboarding/import-wallet-flow/ImportSeedPhrase.tsx#L31-L43

const errorsMap = useMemo(() => {
  return seedPhrase.map(word => (word ? !wordslist.includes(word) : false));
}, [seedPhrase, wordslist]);

const isError = useMemo(() => errorsMap.some(error => error) || isErrorProp, [errorsMap, isErrorProp]);

const isValid = useMemo(() => seedPhrase.every(word => wordslist.includes(word)), [seedPhrase, wordslist]);

const handleSubmit = useCallback(() => {
  if (onSubmit && isValid) {
    onSubmit(seedPhrase.join(' '));
  }
}, [onSubmit, isValid, seedPhrase]);

isValid passes as long as every cell contains a word from the 2048-word BIP-39 English list. It never calls validateMnemonic(seedPhrase.join(' ')), so a phrase whose last word's 4-bit checksum doesn't match the SHA-256 of the first 128 bits of entropy is still treated as valid. The submit handler forwards the string unchanged to the onboarding navigator → Welcome.tsx#L173-L174, which stores it and proceeds to key derivation. No downstream layer re-validates checksum.

Receipts (evidence chain)

Signal	Source	What it proves
isValid only checks wordlist membership, never validateMnemonic	ImportSeedPhrase.tsx#L37; git blame → commit 4159cfeb (Julian, 2025-02-03)	The import form has no BIP-39 checksum gate, and it's been missing since the onboarding UI was rewritten.
Correct validateMnemonic validator exists in the repo but is imported from nowhere	SeedPhraseInput.tsx#L54; grep -r "from.*SeedPhraseInput" returns zero hits	The repo has the right code but it's dead. The wired-up component (ImportSeedPhrase.tsx) is a separate implementation that omitted the check. Same bip39 dependency already installed — the fix is one line, not a new dependency.
Downstream derivation silently accepts any string	src/lib/miden/back/vault.ts#L610-L627 — mnemonicToSeedSync(mnemonic) → derivePath("m/44'/0'/${walletTypeIndex}'/${accIndex}'")	The consuming layer cannot reject a bad phrase; PBKDF2 turns anything into a seed. This is what produces the "deterministic but unrelated wallet" symptom the reporter saw.
bip39.mnemonicToSeedSync performs no validation	node_modules/bip39/src/index.js#L52-L56 — body is only pbkdf2Sync(mnemonicBuffer, saltBuffer, 2048, 64, 'sha512')	External confirmation that the library itself doesn't catch invalid mnemonics — validation has to happen at the UI boundary.
BIP-39 spec mandates checksum	https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki#generating-the-mnemonic — last 4 bits of a 12-word phrase are SHA-256(entropy)[0..CS]; wallets MUST reject phrases that fail this check	The canonical "all abandon" test vector is actually 11× abandon + about (not 12× abandon), so 12 identical words fail checksum by construction. A compliant wallet rejects the repro input.
Both onboarding entry points share the same submit action	Welcome.tsx#L173-L174 and ForgotPassword.tsx#L73-L76 both handle import-seed-phrase-submit	A single fix at the form level covers both entry points — scope of the bug and the fix is well-bounded.

Suggested direction

Make the onboarding import screen a thin superset of the existing per-word check by also calling bip39.validateMnemonic on the joined phrase before enabling submit — exactly the pattern that SeedPhraseInput.tsx#L54 already implements (including the formatMnemonic normalisation from src/app/defaults.tsx). The per-word error map stays useful for highlighting typo'd slots, but isValid / the button-enabled gate should additionally require a valid checksum over the full phrase, and the error message should clearly distinguish "invalid seed phrase" (checksum mismatch) from "typo in word N" (wordlist miss). Because the ForgotPassword flow routes through the same import-seed-phrase-submit action, it inherits the fix automatically. Longer term, collapsing the two seed-phrase input components (ImportSeedPhrase.tsx vs the unused SeedPhraseInput.tsx) into one would prevent this class of drift.