SOS. Critical problem with ICPSwap!

[plsak]

Hi, I think this is a nice description from @peterparker

@peterparker

The domain name used to sign in is tied to the principal that is generated. If ICPSwap consistently used app.icpswap.com, regardless of whether identity.ic0.app or identity.internetcomputer.org was used, the same principal is generated.

[peterparker]

@Ajki

can a dApp receive different anchor associated with the same Internet Identity?

A dapp cannot receive an anchor, a dapp can receive a principal.

To sign-in in Internet Identity one used what was called an anchor which is now called an identity (I think).

Regarding the II domain, please let me know if the answer pointed above resolve your question or if I should add anything.

[Ajki]

@peterparker

Regarding the II domain, please let me know if the answer pointed above resolve your question or if I should add anything.

Indeed, if the principal remains constant, it would be inconceivable for an individual logging in with the same identity on @ICPSwap to be linked to a different wallet.

What sort of glitch or malfunction would be necessary on @ICPSwap’s end to allow such an anomaly to occur?

[peterparker]

@Ajki

What sort of glitch or malfunction would be necessary on @ICPSwap’s end to allow such an anomaly to occur?

I took a step back to think about it, and I’m going to share here a hypothesis: What if there actually was no glitch, no malfunction, and no bugs?

Let’s accept that:

• Internet Identity worked as expected, generating the same principal for the same domain/anchor.
• ICPSwap did its due diligence work and never changed their code or configuration.
• OP always used the same anchor.

In other words, everything is and was set correctly, and all login information was constant.

Now, here’s the hypothesis and a potential scenario:

What if the OP didn’t always use a bookmark to access https://app.icpswap.com/, but inadvertently used a back link, for example in a blog post, or forum post or such as one indexed in Google Search, to access ICPSwap on its canister-ID URL https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app/? After all, it looks exactly the same, both links and dapps.

So, without noticing, OP might have opened this latter URL, signed in with Internet Identity, and given that another domain was used for sign-in, Internet Identity generated another principal.

This would be a possible scenario I can think of; however, to be proven, OP would have to confirm that they don’t use bookmarks absolutely 100% of the time.

And again, this is an absolute hypothesis, think of it more like a private detective throwing out an idea to solve a mystery on MythBusters.

PS.: an example of back links I’m referring too

[Ajki]

In that case, @ChauDoan21165 simply needs to log in at both addresses and examine the wallet; he will likely find his funds in one of them.

https://icpswap.com
https://rv6ki-dyaaa-aaaah-aaa5q-cai.raw.ic0.app

In the event that he doesn’t find a wallet with funds, what kind of code changes could @ICPSwap make to change a connection between the principal and the wallet? It’s not as if they can access his funds, so malicious intent shouldn’t even be a consideration.

[peterparker]

@Ajki

both addresses

Both addresses are following I think:

https://icpswap.com/
https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app

But again that was an hypothesis, so maybe there is some other back links and/or other canister ids?

@Ajki

what kind of code changes could make to change a connection between the principal and the wallet?

Not sure what you mean here, I just gonna assume you are refering to what can make a principal become different. As already staten, it’s to my knowledge either different domain or different anchor, nothin else.

[ChauDoan21165]

Thank you guys for your comments. We need your help. I will read all again to make sure I understand everything you wrote correctly. We tried with other computers and phones and they all lead to new address on ICPSwap.

[Ajki]

Did you try to connect to both addresses and check the wallet?
https://icpswap.com/

ICPSwap - ICP

Did @ICPSwap used any other canister address before. (not likely since more would have same problem then)

[frederikrothenberger]

Hi @ChauDoan21165

As others already have said, there seem to be a few test versions of ICP swap available:

• https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app
• https://zuiuq-qqaaa-aaaan-qa4cq-cai.raw.ic0.app
• https://rv6ki-dyaaa-aaaah-aaa5q-cai.ic0.app
• https://rv6ki-dyaaa-aaaah-aaa5q-cai.raw.ic0.app

Please check that none of these show a balance.

---

@ICPSwap: Even if you have consistently used https://app.icpswap.com, was the front end always exclusively hosted from AWS as it is now?

If you had the front-end served from a canister using the custom domains feature (i.e. accessible on https://app.icpswap.com), during that time it would also have been accessible on https://<canister_id>.ic0.app.

• Could please you confirm that the domain app.icpswap.com has never pointed to a canister?
• Could you also please list all canisters that were ever used to host some version of the ICPSwap front end? I.e. tell us whether the list above is complete?

[frederikrothenberger]

@ICPSwap: Can you please also confirm that you never used https://3pbcj-viaaa-aaaah-qaajq-cai.ic0.app for the app and to connect to II?

[ChauDoan21165]

No, I never used [https://3pbcj-viaaa-aaaah-qaajq-cai.ic0.app](https://3pbcj-viaaa-aaaah-qaajq-cai.ic0.app.

[ChauDoan21165]

If I can connect to the old wallet, then it would not be any problem. Just led to new address.

[ChauDoan21165]

just to ICPSwap and click to Internet Identity

[Ajki]

We must await @ICPSwap response before moving forward. @ChauDoan21165 , I ask that you click on each link in the preceding posts, connect using Internet Identity, verify the wallet, and then report your findings.

[ChauDoan21165]

@peterparker

https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app/

I use the link you gave me: ICPSwap that created another address:
Account ID

77b764ebb51f4df0b88997c71524d0f8f0d7b0c58fd67806941337183e033c0c

Principal ID

5ovdt-emhqs-q5gsa-7wtmq-dnns7-cshvj-q6yfx-a2izx-jemr2-xxuyj-vqe

[ChauDoan21165]

For 4 links: * https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app

• https://zuiuq-qqaaa-aaaan-qa4cq-cai.raw.ic0.app
• https://rv6ki-dyaaa-aaaah-aaa5q-cai.ic0.app
• https://rv6ki-dyaaa-aaaah-aaa5q-cai.raw.ic0.app
  First two links gave me two new addresses.
  I am hesitant to log in the 3,4 link since it ask me wallet name, passwords, mnemonic.

[peterparker]

@ChauDoan21165

that created another address:

And did you find funds there or it was empty as well?

[ChauDoan21165]

Of course those are empty, totally new addresses!

[peterparker]

Thanks for the feedback. No further idea unfortunatelly from my side so let’s wait for @ICPSwap to answer the above recent questions.

[ICPSwap]

Many thanks to @frederikrothenberger @peterparker @Ajki for helping and sharing the information.

Replied as below:
1/ The IC URL, https://zuiuq-qqaaa-aaaan-qa4cq-cai.ic0.app is for ICPSwap V3 Test Version. This version used TICP test tokens to interact and does not have liquidity related to SNS tokens.

2/ The IC URL, https://rv6ki-dyaaa-aaaah-aaa5q-cai.ic0.app is used for testing ICPSwap with WICP (wrap ICP). This is one of the earliest URLs for ICPSwap but didn’t integrate internet identity at that time.

3/ The IC URL, https://3pbcj-viaaa-aaaah-qaajq-cai.ic0.app is the official website of ICPSwap (www.icpswap.com), not the DApp. It has been used for a long time ago. But it doesn’t connect to any wallets.

4/There is also an IC URL, https://bplw4-cqaaa-aaaag-qcb7q-cai.icp0.io
We briefly used this container to deploy the frontend around the end of May 2022, approximately lasting for 2-3 days.