As a first-time user, the UI doesn't immediately make sense to me.

Here are some of my specific issues. All of these could be fixed by adding either some help text or a fly-through tour using something like Bootstrap Tour.

• I was confused about the "Pending Blocks (Waiting for PoW...)" title, so I googled it and found a LOT of other confused people.
• I was also confused when going to "Receive" that there was a field for "Amount" (I had to google this as well to discover that it's optional).
• I can't actually copy my existing receive address from the "Receive" modal.
• "Generate New Account" - what is an account? Should I make a new one every time I want to receive money?
• I can only get a QR code for my account when generating a new one - after that I can't seem to any more.
• Why do the amount fields all say XRB/MRai? Are they different? Am I entering XRB or MRai?
• What is a representative? When would I want to change mine, and what would I change it to?

If you want help with this I could potentially find some time in the coming weeks, but I'm not actually sure I know the answers to these questions well enough to write some supporting help text for them.

It would be nice to have a button on a transaction in the transactions overview to easily send back a transaction to the sender account. Useful when friends lend you money.

The website code is running a new code, but i'ts not in this repo.

Currently the only option we have is to copy and paste wallet addresses into a text box which isn't ideal for most users, a more user friendly and recognisable (in the sense that we can translate an address belongs to person X) approach could be users maintaining their own address books. This way, when users are sending frequent transactions it's a lot easier to keep sending the currency to known associates by selecting from a list.

Thoughts?

It would be nice if you could enable 2FA per account additionally to the whole wallet. This way, a computer virus would not be able to quickly empty your account by sending away all funds after you logged in.

Hello,

I know recently due to some phishing all of the wallet identifiers were reset for users in the database. Did this also apply to the bounty wallet identifier? I was poking around and noticed that identifier wasn't valid anymore.

Found this while testing a micro-transaction.

Screenshot says most of what I know at this time. Need to look into the code but I am at work rn, just wanted to take note here. Sorry can't be of more help.

The Send menu dropdown lets me choose accounts and shows one value (incorrect) but the wallet itself shows the right values. Not a big deal but hey, maybe one day 0.000001 xrb won't be as insignificant.

Just a thought: consider using a memory-intensive KDF like scrypt instead of pbkdf2. I noticed on the TODO list the option of setting one's own interation count. This would be a way to skip that need. And as such, recommend to folks to setup the wallet on a powerful desktop and just suffer the increased latency on mobile phones. Making it dynamic would be difficult since Web APIs don't offer a means to querying system resource information, so the amount of memory and cpu can be configurable...

...and now that I'm typing it all out, maybe allowing one to set their own pbkdf2 interation count is easier, lol.

It seems the From field shows the address of the receiver instead of the sender in the transaction overview page. The "To:" field is correct and shows the receiver.

I tried sending back an amount that I received from a friend, but when using the From address I turned out sending the coins to myself.

It seems workers are spawned fine, but when calling pow_callback the ready and callback functions are not triggered. Something is failing there.

https://github.com/jaimehgb/RaiWebWallet/blob/master/js/custom.js#L330

This might be a feature, but there is currently no warning telling you that you actually send money to your own account when you (accidentally?) fill in your own address.

there's no 2fa.
no import wallet
lots missing but let's just start with those two?

what is this with unpocketed change? why would there be such a thing?

https://raiblocks.net/account/index.php?acc=xrb_1wq5wjcw9ijddzs4cj1je3k9aww7c8s8n5jwt76ddmnp4ddb7bm4t5urfd8r when i typed this my money is "not pocketed." maybe that will change?

Disclaimer before anybody freaks out:
This could be a non-issue, but I don't know enough about the inner workings of RaiBlocks to be sure if it is actually a security issue and I figured it was my responsibility to report it here.

The problem:
It is possible, from the same wallet seed, to produce multiple wallet identifiers, whether from the same email/password combination, or differing email/password combinations, in which all these varying combinations produce varying wallet identifiers albeit with the same address - that is, the same public key.

Steps to reproduce:

1. Use a valid wallet seed from the window that is opened by clicking "recover your wallet with your wallet seed"
2. Provide any valid email and password - you will see it doesn't matter what combination you choose, the address in the wallet will be the same (though not the wallet identifier)
3. You get the window that gives you your wallet identifier and the wallet seed (wallet seed shown should be the same wallet seed you provided)
4. Upon clicking "go to your wallet" - you will see the address is always the same, indifferent to what email or password you provide

Main concern:
My concern is that an attacker could do this thousands/hundreds of thousands of times, and then send various different transactions from these multiple wallets simultaneously, creating a challenging and confusing load on the network - on the blockchain all the requests would appear from the same address. Again, this could mainly be mitigated by the blockchain itself - I'm not a RaiBlocks expert so I'm not sure if this would be the case.

Possible solution/mitigation:
Not sure; we can't test if the email or password match the seed, since you don't store the seed server side...

But... you could limit the number of times an email can register with a seed, indifferent to whatever seed they are using, just get the times the email pings the server - this could prevent a lot of spamming, which could be a recurring issue as RaiBlocks gains popularity/market cap. 😊

It would be nice if the server would send the account holder an email when funds are received. I realize this might increase server load. As an alternative, it could be implemented using a HTML5 notification when the user keeps the page open.

I've seen this with myself and a few other users of the wallet through the raiblocks discord channel... this is where the raiblocks have been successfully placed on the blockchain, but they don't show anywhere on the wallet GUI.

The quick fix was to log out of my wallet and log back on again - I'm assuming this is just a front-end error from not updating from the server, but can't be sure.

Hello,

i am not really experienced with github, i am sorry if the thread here is on the wrong place.

i would like to contact jamiehgb, its about the railwallet bounty, i have one question to ask to continue with the work to get the passwort :D any help?

Composer could not find a composer.json file

I can't fix this as the code isn't public. Essentially if the 2FA box has something in it from the last login which can occur for me with Chrome and LastPass then you have to manually edit the display:none on the 2fa box

Hello, missing file ajax.php

So this morning I tried to send a small amount of XRB from one address to another address of mine, just to feel how quick the whole process is.
My whole balance is A. After I sent B XRB from address 1 to address 2, the wallet reported I have A + B XRB which is not correct. After a refresh and re-login it reported correctly.

I think this is just a small thing (I don't want to say bug because it's unharm) but if you guys can fix this it would be better I guess.

When attempting to recover a wallet using the generated seed, the email address is not allowed to contain + characters. For example, "[email protected]". However, a + sign is however a valid email address. Also note that it is possible to create an account that uses an email address containing a + sign, it's only when an attempt is made to recover the wallet that it goes wrong.

• Update Readme so people can start contributing

After login you go to:
https://raiwallet.com/home

However if you refresh the browser you then return to the site root. Ideally a page refresh should respect the current page / routing and refresh that instead.

Testing on Windows 10 in Chrome.

I think it's somewhat specific to my wallet config as the web wallet seems to work ok when I create a new account.

I know that I created several receive accounts - perhaps that is related somehow.

I can look into the code flow/reproduction steps a little more deeply later, but thought I'd see if anyone else was having a similar/the same problem.

Here's the error/stack trace:

Uncaught TypeError: Cannot read property 'getHash' of undefined
    at resolve (main4.js?v=1.0.2:2758)
    at Object.success (main4.js?v=1.0.2:2818)
    at i (jquery.min.js:2)
    at Object.fireWith [as resolveWith] (jquery.min.js:2)
    at y (jquery.min.js:4)
    at XMLHttpRequest.c (jquery.min.js:4)
resolve @ main4.js?v=1.0.2:2758
(anonymous) @ main4.js?v=1.0.2:2818
i @ jquery.min.js:2
fireWith @ jquery.min.js:2
y @ jquery.min.js:4
c @ jquery.min.js:4
XMLHttpRequest.send (async)
send @ jquery.min.js:4
ajax @ jquery.min.js:4
n.(anonymous function) @ jquery.min.js:4
resolve @ main4.js?v=1.0.2:2760
resolveForks @ main4.js?v=1.0.2:2848
(anonymous) @ main4.js?v=1.0.2:2729
i @ jquery.min.js:2
fireWith @ jquery.min.js:2
y @ jquery.min.js:4
c @ jquery.min.js:4
XMLHttpRequest.send (async)
send @ jquery.min.js:4
ajax @ jquery.min.js:4
n.(anonymous function) @ jquery.min.js:4
checkChains @ main4.js?v=1.0.2:2691
goToWallet @ main4.js?v=1.0.2:2910
(anonymous) @ main4.js?v=1.0.2:3040
i @ jquery.min.js:2
fireWith @ jquery.min.js:2
y @ jquery.min.js:4
c @ jquery.min.js:4
XMLHttpRequest.send (async)
send @ jquery.min.js:4
ajax @ jquery.min.js:4
n.(anonymous function) @ jquery.min.js:4
(anonymous) @ main4.js?v=1.0.2:2991
dispatch @ jquery.min.js:3
r.handle @ jquery.min.js:3

When pasting an address in, many users stress about somehow missing a character or making a mistake in some other way, sending to some address that nobody owns. See this issue from official repo.

Could it show a reassuring "this is a valid address" statement (and perhaps even fetch basic info about it such as the current balance of that address, how many blocks) when a valid address is entered? Perhaps in green? And a red "this is not a valid address" otherwise. And maybe orange (or blue?) for "this is a valid address but has no open block on the network yet, is it a cold/offline wallet?"

I check Local PoW checkbox and get message "Preferences updated. PoW will be generated at client side now."
Then I sign out and then sign in again.
Go to Settings and see Local PoW option unchecked.
Result: local PoW never generates and I see the "Pending Blocks (Waiting for PoW ...)" message forever.
This happens both in Chrome and Firefox.

Right now, client side PoW is the default option for all computers. There should be a compatibility check on startup and when a user changes the PoW settings at the settings page.

Hi,

It would be nice if the wallet has a no signup/account mode, where the seed is only stored with the user. All operations done locally and nothing stored on the server. Something like myetherwallet for ethereum.

https://www.dropbox.com/s/q67q9qs16rz5wj7/Screenshot%202018-01-02%2021.46.37.png
Chrome on Mac OS

https://www.reddit.com/r/RaiBlocks/comments/7mkmrg/bug_send_raiblocks/

Solution (refresh)
go settings and check Local Pow. Not working for me

I need help!

best regards,
Frederick

Apologies if this is your own work, but the PoW stuff appears to have been sourced from elsewhere without attribution

Check the following screenshot:

Due to the page not being properly responsive, the address trails outside of the right <body> bounds. A user may copy an invalid address like this and lose funds on exchanges that do not validate withdrawal addresses such as BitGrail.

This could be fixed by either showing the accounts above or below the list of transactions by default, or based on media queries when the screen size is too small. Additionally, a "copy address" button could be added like in the Coinomi wallet so the user can be sure the right address is copied in full without selection mistakes.