Alex Brou

[Alex Brou @originalexbrou]

@bitrequest @peachbitcoin @cakewallet @bitrequest I am deploying a tool that searches all op_returns for a specific substring. Would that be helpful to you?

[Alex Brou @originalexbrou]

DO NOT USE CAKE WALLET!

i was a fan until i realised a big problem.
if you scan a Bitcoin payment QR code (BIP-21) the "message" field is written as an OP_RETURN without informing the user. this is a MASSIVE privacy issue.

context: i'm the cto of @peachbitcoin

@cakewallet

[Alex Brou @originalexbrou]

@bitrequest @peachbitcoin @cakewallet Oh boy…

[Alex Brou @originalexbrou]

@Chevron8Net @peachbitcoin @cakewallet tell me more!
btw, the Peach App has a wallet inside, which is the latest version of BDK. It’s working pretty well!

[Alex Brou @originalexbrou]

@kucoincat @peachbitcoin @cakewallet It was meant to be wild, I wanted to show my disappointment with cake as a user as well.
I don’t know if this is affecting other currencies.

[Alex Brou @originalexbrou]

@DSackys @peachbitcoin https://t.co/cRlW9zF3D4

[Alex Brou @originalexbrou]

@DSackys @peachbitcoin hello! can you tell me the version and the phone you are using? i tested on Graphene and it is working fine.
maybe join our telegram group, so we can speak with ease

[Alex Brou @originalexbrou]

@shorewalletapp @peachbitcoin @cakewallet also waiting

[Alex Brou @originalexbrou]

@Qbiteeth @peachbitcoin @cakewallet join our telegram group and find out! It’s a big big daycare 🙂

[Alex Brou @originalexbrou]

@kucoincat @peachbitcoin @cakewallet Yes. QR code scanning or pressing the QR code which opens the Cake Wallet app

[Alex Brou @originalexbrou]

final thoughts on this:
- the peach app has been updated: it doesn’t use the “message” field
- cake hasn’t been updated
- I didn’t see an official communication from cake saying “don’t scan QR codes until we release an update”
- will build a tool to query op_returns by substring

[Alex Brou @originalexbrou]

@GeorgeAtlanMail @OrangeSurfBTC @peachbitcoin @cakewallet Cake wallet uses op_return for some functionalities on bcash or wtv…

[Alex Brou @originalexbrou]

@dobsec @sethforprivacy @peachbitcoin @cakewallet @OrangeSurfBTC Yes, I went public with it first. And yes, I still believe the users that suffered deserve an apology.
At Peach, some users complain about some things directly on Twitter. Sometimes they are wrong, but we never criticize the fact they did it on twitter: we assume responsibility.

[Alex Brou @originalexbrou]

@CrownedDefi Eeeeeasy. If people download cake today they still have the same bug.

[Alex Brou @originalexbrou]

@sethforprivacy @ProfEduStream @callebtc @peachbitcoin @cakewallet Did you push new code to GitHub? Can’t see any new commits on the “dev” branch

[Alex Brou @originalexbrou]

@fluffypony I deleted a previous reply to you.
In any case: don’t turn this against me: cake wallet made a big big mistake, and I came to announce to the world to be aware of that bug.
I could have done differently, but i don’t regret doing it the way I did. I’d do it again

[Alex Brou @originalexbrou]

@sethforprivacy @SAP127001 @peachbitcoin @cakewallet The question is: would this happen if AI was involved?

[Alex Brou @originalexbrou]

@SahilC0 peach users have been affected by this in a permanent way. It defeated the no-KYC aspect of peach for them.
this is not “fear mongering”, this is actual damage. Maybe you can enjoy the luxury of being public about everything you do. Some peach users can’t afford that luxury.

[Alex Brou @originalexbrou]

@sethforprivacy @peachbitcoin @cakewallet I am happy to hear that!

[Alex Brou @originalexbrou]

@walitysch1 @sethforprivacy @peachbitcoin @cakewallet @OrangeSurfBTC Only if you used the QR Code scanner or if you pressed on a Bitcoin payment link that contained the “message” field.
The “label” field is more commonly used, but the “message” field is still valid to use.
So the answer: maybe yes.

[Alex Brou @originalexbrou]

@OrangeSurfBTC @peachbitcoin @cakewallet Not likely, 100% sure.
Unless there are other wallets that have this bug (I doubt it, but still possible).
Regarding the intention: I also believe it’s not intentional, but intentions will not rewrite the blockchain.
Again, thank you for your interest in validating this.