Symbol Launch - Opt In Issue Affecting 35 accounts
It has come to our attention that there is an issue affecting < 0.1% of opt in accounts, it specifically affects people who opted in from the mobile app (iOS or Android, both are affected).
This issue means you will not have received your XYM and need to contact the helpdesk to arrange for you to receive it.
We know the exact root cause and exactly which NIS1 accounts were impacted, if your account is not in the list below, this does not affect you.
- 35 NIS1 accounts have an issue with mobile opt in
- If your account is in the list below, please contact helpdesk for your XYM
- Total tokens involved is ~280k
- NIS1 tokens are unaffected
- NGL have locked all the affected Symbol accounts under multi-sig
- Further detail on root cause and what happened below
The short version:
- There is an issue in one of the underlying libraries that mobile opt in uses and it means 35 accounts have opted into 2 Symbol accounts.
- The first person to log into those 2 accounts has moved them to another account.
- Anyone who logs in after, will see a transaction that appear to empty “their” account - the problem is the account was shared by 35 people due to the issue.
The more technical version for full transparency (can be checked in Github as well). The library that was used in the mobile apps, accepted a null value and derived it to a valid path - it results in approx 50 possible valid private keys. Additionally, the NGL code did not test that input for null. It is a very hard issue to reproduce and in order for that value to be null, its likely something like internet connection dropped briefly, app lost focus at just the wrong time etc.
The net effect is that the opt in was valid, its just it was opted into one of the ~50 possible accounts, 32 of the optins went to one Symbol account and 3 went to another. This is why we know exactly which NIS1 and Symbol accounts are involved.
If you contact the helpdesk and flag that your account is one of the 35 on this list, we will arrange for expedited distribution of your XYM along with an apology for the inconvenience and a complimentary Ledger device (no KYC with NGL needed) for your trouble.
Helpdesk: NEM Helpdesk
Affected NIS1 Accounts
Corresponding Symbol Addresses for NIS1 accounts above: