User logging into account with social shows the wrong wallet address

We have a user logging into our platform with social account but the wallet address associated with this account isnt the one which Torus is providing back to us. We believe the user has signed up twice with the same email and hence it has created multiple wallets.

Subsequently, when they now login to the platform, it shows the wrong account and he cant access the right wallet account.

The correct wallet address is: 0x06acbbdd0fdd5a91f42707d44f364b2672b9b426

However, the wallet address passed back by Torus is: 0xb52470D1CDb1eAC71Ef069dB94D98A73AA207Ce9

How do we retrieve the correct wallet address on the account?

  • SDK Version: 2.1.3
  • Platform: Web3Auth / Torus Integration

@gareth Welcome Aboard!

Web3Auth accounts are scoped to applications (clientId) which generate different wallet addresses.

The other reasons are:

  • Different verifiers being used
  • Different client ids
  • Different social logins (email passwordless and google is not same)
  • Torus wallet accounts are different from Web3auth accounts.

You may refer to the below documentation to learn more:

Thanks for the explanation @vjgee. So the account was created with the same clientID, however, what has added to the complication is that the user changed his email after registration to the same email as the other wallet. If that makes sense?

So he signed up, using email and we generated the wallet. He then signed up again with a different email and we subsequently generated another wallet. So now the user has 2 wallets with two accounts which is expected behaviour.

The issue is that he changed his email on one of the accounts to the same as his other account. So now, we can’t seem to unassociate the two accounts and show him the correct account. Anything you can help with?

Thanks for your patience.

Email addresses cannot be updated as they create a unique wallet address. You cannot link two wallet addresses generated from different email address to a single email address. How is the user doing this?

Do you have a link to your Dapp to check the flow?

Thanks @vjgee - You can see the process here: https://app.fantium.com

The two different emails end in web.de and gmail.com.

Thanks

@vjgee could you please take another look into this? Let me or Gareth now if there are any questions.

@gareth Thanks for your patience.

You are allowing users to update their email address in the profile settings once they are logged in?:

Can you provide the 2 wallet addresses so I can check with our team which address is associated with the corresponding email?

Hi @vjgee
Here are two wallet addresses:

  • 0xb52470D1CDb1eAC71Ef069dB94D98A73AA207Ce9
  • 0x06acbbdd0fdd5a91f42707d44f364b2672b9b426

As they can log in with a wallet, we need them to be able to update their email on their account for communication and KYC etc. So thats why we allow them to update their email, but the association of user_id and uuid (wallet address) shouldn’t be effected?

Thanks
Gareth

Hi @vjgee

Here is another example of a user who has three accounts with the same credentials, i.e. they signed in with email, social logins and wallets, but they are the same person, can you confirm access to the accounts and what emails are assigned to each one as they are the same user:

  • 0x9d0a60963456ee2f2f97c7dc3ba3bde3b44aa6cf
  • 0x73b2737ab7e24d79bdbe537f623aa1a1a9365516
  • 0x1e7c0d34bcc5a9d95509606808af5349d6ca93d8

Thanks

Hi @vjgee - any news? Can you please get back to me.

Also, is there any premium support we can sign up to, as these issues are critical to our platform.

Thanks

Here is the information you asked for :
0x06acBbdd0Fdd5A91f42707D44F364B2672b9b426 google fabianfischeer@gmail.com

0x1e7c0d34bcc5A9d95509606808AF5349D6CA93d8 google 25107gcz@gmail.com

0x73B2737aB7e24d79BDBe537f623aa1a1A9365516 torus-auth0-email-passwordless andi25107@hotmail.com

0x9d0A60963456ee2f2F97C7Dc3bA3bDe3b44aA6Cf facebook 7253174784711094

0xb52470D1CDb1eAC71Ef069dB94D98A73AA207Ce9 torus-auth0-email-passwordless fabian.fischer001@web.de

You can upgrade to Scale or Enterprise plan for enhanced support. Web3Auth | Pricing - Personalised plans for everyone!

Thanks @vjgee - With this user:
0xb52470D1CDb1eAC71Ef069dB94D98A73AA207Ce9 torus-auth0-email-passwordless fabian.fischer001@web.de

He said he never received his seed phrase, can you resend it, or can you provide options for the user to get in touch to try recover his account.

Thanks

The same has occurred for these users as well:
Mcgandalf888@gmail.com
lukasluetzenkirchen@web.de

They said they never received their seed phrases so they cant access their account. Please can you resend or provide options for them to get in touch and recover account.

We are a non-custodial wallet and this information is not stored in our servers so there is no option to resend it. The screenshot indicates the date & time the phrase was sent. The user must have deleted the email or it might have ended up in the spam folder. The backup phrase is sent automatically when the user enables 2FA.

Ask the users to check their inbox and spam folder thoroughly for the backup phrase. It was sent there. They can search with the script “from: hello@tor.us or no-reply@tor.us subject: backup”.

Ok thanks @vjgee - Are there any other options for the user if he cant find his seed phrase? Should we ask him to get in touch with you directly?

With one of the other users on the list above:
0x1e7c0d34bcc5A9d95509606808AF5349D6CA93d8 google [25107gcz@gmail.com]

When they logged in with Google, they are presented with a completely different wallet shown:
0xA3033900182A597865dbB8Dd7f3791983Cbd7D2D

Can you investigate this one please?

Thanks

Have you upgraded to the latest SDK version?

You need to share your implementation code for our team to check.

Not yet no, but these are problems from existing users from a few months ago. We are looking to help them as they are trying to log directly into Tor.us as at the moment, they cant even access the wallets within your infrastructure, regardless of our system setup

Thanks

Hi @vjgee - we have checked all our personal and business accounts for emails relating to seed phrases and nothing is being sent out. When the user signs up, they should be receiving this email but there is no evidence of this so is there an error on your system to not send these out, or a trigger which needs to be used to send these out?

Thanks

To help narrow down the search, we have done some testing and this is one of the accounts used:

Never received a recovery phrase email, but in your platform, you have a message saying it was sent to the gmail address. Looks like there is a bug on your end and these arent being sent out.

Thanks

I will check this with our team and get back. There is no bug at our end since the phrase is always sent to the recovery email address provided the user opts for that. If he opts to download the phrase manually and does not make a note of it then that is an issue which we can’t control.