1

I am working on something that relates the ownership of the ethereum account address. I have a situation depicted as follows:

Someone issues a token and issuer KYCed(off-chain) my ethereum account address, So I am able to hold or buy the tokens from the crowdsale. But somehow I lost the private key of my wallet now I am not able to access my account, I quickly contact to my token issuer which has some backdoor mechanism (Not known for now but let's predict issuer has some magic) to transfer those tokens from my previous account to new account but the problem now for token holder is to verify the ownership of its lost account.

So what will be the feasible ways to prove the ownership of the address?.

I know this is something a researched base question but I really want the inputs to formalize the idea.

Any inputs are appreciable.

1

So what will be the feasible ways to prove the ownership of the address?.

The only way of verifying ownership of an address is the private key. If you don't know the private key you don't own the address. If you somehow 'lose' the private key you lose ownership of the address.

There is no way of verifying that they did own the address unless you put some verification mechanism in place before they 'lost' their private key.

You could for example have a second contract which stores a mapping of addresses => signed messages whereby the signed message is a message signed with a secret that only the user knows.

Parts of the ENS contracts work on the premise of secrets whereby only the user submitting the hash knows the secret and can thus validate the authenticity of the signature at a later date.

The problem is that if your user 'lost' their private key they will probably also forget their secret. Furthermore getting people to sign a message is another onboarding hoop that perhaps your users won't want to go to the effort of completing.

Basically. Your users should just not lose their private keys.

  • Yes, You sounds 100% right but I am trying to figure it out the mechanism that makes that process possible somehow so it never be the single point of failure. If the user lost its private key then somehow user has some other secret or any OTP kind of stuff using that user is able to prove its ownership over the address. I am very open to doing one more step for token holders (for getting more flexibility they need to do one more step). I don't understant the ENS part how it will work. – Satyam Agrawal Aug 8 '18 at 7:05
0

Some backdoor mechanism (not known for now but let's predict issuer has some magic) to transfer those tokens from my previous account to a new account:

There's no magic here.

On the issuer's contract, your account is simply mapped to the amount of tokens given to you.

If you can persuade the issuer to transfer them from this account to your new account, then the issuer will only need to map your new account to the same amount, and then map your previous account to zero.

Something like:

balances[newAccount] = balances[oldAccount];
balances[oldAccount] = 0;

Take a look at StandardToken contract by OpenZeppelin.


With regards to the actual question and hand:

After KYCing you, the issuer will have to store all your personal information (used in the KYC process) alongside your wallet.

But while this will be sufficient for allowing a user to replace his or her account, it will also pose a serious risk of their personal information leaking to the public.

Ideally, you would want your personal information to be completely deleted after the KYC process is complete.

This is probably not going to happen, but as a compromise, those details should by the least not be stored on the issuer's off-chain servers, and remain only on the servers of the third-party company who has conducted the KYC.

  • Yes, I know about the backdoor mechanism. but that is not my concern. and yes the KYC activity is performed by the third party company so it may be possible that the data will reside on third-party servers. But you still did not give the answer to my question about proving the ownership of the account If I lost my private key. – Satyam Agrawal Aug 8 '18 at 6:57
  • @SatyamAgrawal: I did. Quote: "After KYCing you, the issuer will have to store all your personal information (used in the KYC process) alongside your wallet... this will be sufficient for allowing a user to replace his or her account". – goodvibration Aug 8 '18 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.