Cardano With Paul Check SecondFi Recovery Limits

Users wey SecondFi June security incident affect fit now check which assets dey available for recovery and request make dem deliver am go new Cardano wallet. The tool launch on October 7 as SecondFi dey wind down operations. For him walkthrough, Cardano With Paul explain how the process dey work and where e no fully solve users remaining exposure.

How SecondFi Recovery Works

SecondFi, wey people formerly know as Yoroi, get separate tools for migration and recovery.

Migration dey move assets wey still dey inside wallet, while recovery dey handle eligible assets wey the incident affect. This one include funds wey white hat security specialists move enter safekeeping using the same vulnerability wey malicious attackers exploit.

The recovery tool dey check the affected wallet addresses, show eligible assets, and generate cryptographic proof wey go link the request to a new destination. SecondFi advise make people allow up to five working days for processing.

The receiving address must belong to newly created Cardano wallet wey the user control, including hardware wallet. Exchange deposit addresses no dey allowed.

Paul use temporary test wallet demonstrate the initial checks because e no get affected wallet available. So him video cover the interface and the published instructions without to complete actual payout. E still report say accounts of recovery outcomes dey conflict, especially for assets wey malicious attackers take instead of the ones wey white hats secure.

Recovery Phrases and Compensation Limits

The process require the affected wallet recovery phrase to generate zero-knowledge proof. SecondFi documentation talk say processing dey happen local for the browser, and na the proof dem go submit, no be the phrase. Paul question the decision to require entry through website and highlight the danger of imitation portals. Na only the old wallet phrase dem involve; the new destination just need im public receiving address.

That distinction no mean independent security assessment. As at the time of recording, Paul no know of publicly available source code for the tool and e rely on SecondFi description of how e dey handle wallet credentials.

Recovery amounts still get limits. The allocation wey dem display na estimate and fit different from the final return. Eligible NFTs wey dem secure for recovery fit return directly; the ones wey no fit return go receive fixed allocation of 30 ADA each, without individual valuation. The destination address no fit change after submission, and the official process no require recovery fee or advance transfer of funds.

Midnight Redemptions Remain Exposed

Users wey dey wait for more NIGHT tokens through Glacier Drop get separate problem. Allocations dey unlock in stages and dem dey deliver am to the Cardano address wey person designate during the original claim process. To move existing wallet balance go another place no go redirect those later deliveries.z

Paul consider to redeem the tokens and transfer dem immediately go another wallet, but e describe am like race against any attacker wey dey monitor the compromised address. E still discuss to pay redemption fees from another wallet, but that one still mean the tokens go arrive for the original destination. Any of the two approaches no dey remove the risk say attacker fit take dem before the holder fit act.

SecondFi guidance warn say future NIGHT redemptions wey dem send to affected wallets fit drain and dem fit no recover am. Successful recovery payment no dey restore the security of those wallets or change the destination wey dem register for Glacier Drop. So users fit receive eligible assets for their new address while subsequent Midnight distributions still tie to the compromised one.