onflow
Incorrect derivation path passed to the Ledger by Flow-Port when creating a Flow account
When I create a Flow account using Flow Port ( https://port.onflow.org/ ) connected to the Ledger device, the derivation path displayed by the Flow app on the ledger device display is m/44'/1'/769/0/0 .
This derivation path looks very wrong on many levels (1' means BTC-testnet, the account number 769??, no hardened derivation for the account number etc).
My understanding is that the correct derivation path for Flow accounts should be m/44'/539'/x'/0/0 where x is the account number.
This incorrect derivation path could cause the Flow accounts derived from it to become stranded / un-reachable when the issue is fixed in Flow-Port, unless some code is implemented to look for already existing accounts previously created with this funky/wrong derivation path.
Hey @loupiote, thanks for your patience on this one! We were focusing our attention on your other report: #435
We're aware of the non-standard usage of BIP39 and we're definitely not happy with it as a long-term solution. We've started to formalize plans for how to improve this -- we absolutely want to make it possible for additional wallets and recovery mechanisms to discover and connect to Flow BIP39/44 accounts (whether they are generated through Ledger or any other means).
We want to have this conversation in open over the coming weeks! To start, I'd love to hear any feedback you might have on this proposal for BIP 44 in Flow wallets: https://github.com/onflow/flow/pull/200
We need to solidify our usage of BIP39/44 before we can do that -- we've got one chance to get this right, and I agree with your earlier point about the bad UX of multiple legacy standards (as is the case on ETH).
Right now we only recommend that users use the Flow Ledger app with Flow Port. Once we finish the above work, we'll implement the standard and provide all users with a way to rotate their keys to non-funky paths. (This is possible because Flow decouples accounts and keys)
In case anybody is concerned, the non-standard path does not make your FLOW funds less secure -- it just makes it difficult for other wallets to reasonably integrate with the Flow Ledger app. It's also a blocker to us properly implementing multi-account support, because the current path scheme doesn't make it easy to discover more than one account.
Sorry for such a question, but when logging into my account I came across this. The device asks you to sign the transaction (44'/1'/769/0/0). What should I do? https://ibb.co/42VTZzW
