Thread by @Wii_Mee

Web3 basics 101 - Your seedphrase is something you want to protect at ALL cost. If you hand out your seedphrase - it's game over for that wallet (+subwallets).

Here’s a🧵about companies entering web3 and not properly putting disclaimers up for user security.

#SaferNFTs 1/10

I chose @Stepnofficial as an EXAMPLE for this🧵, applies to all others.

For those unfamiliar with #STEPN - they are essentially onboarding people to web3 to earn crypto through their app while being active / moving / running. Which - as a concept is a cool idea.

#SaferNFTs 2/10

STEPN launched on $sol originally, expanded to $bnb and now added $eth. Different chains are referred to as realms. Basically = servers, if you're familiar with MMORPGs. Solana Realm, BNB Realm and APE Realm.

Ok, onto the security part already @Wii_Mee!

#SaferNFTs 3/10

So what's the security issue you mentioned in the OP?

STEPN basically is used in-App only - which means, users complety new to crypto will be able to create a new wallet (receiving a seedphrase) for whatever 'realm' they want to participate on.
Here's the BUT:

#SaferNFTs 4/10

BUT because users can create a wallet inside the @Stepnofficial app -

This also means they are given the option to RESTORE their wallets / accounts within the app - by importing their seedphrase. 🚨
Here's where it gets careless from Stepn themselves.

#SaferNFTs 5/10

For the seasoned NFT / web3 users - all alarm bells should be ringing here.

But put yourself in the shoes of someone new to crypto or web3 in general.

Would they know they shouldn't put their seedphrase that they're using for NFTs / funds too in here?

#SaferNFTs 6/10

At the very least (!) I'd expected a big warning like the one I filled inside the box. @Stepnofficial you got to do better than this.

Yes, I know we're entering a seedphrase into MM or other software wallets too. But they're specialized to this sphere. Is STEPN?

#SaferNFTs 7/10

I hope no one in the right mind EVER would think about entering their cold storage seedphrase into a 3rd party app btw. 😱

Now to wrap this 🧵up, let's look at why you should NEVER enter your seedphrase into a 3rd party app.

#SaferNFTs 8/10

Transmitting your seedphrase digitally into apps / websites opens up every door for vectors to steal your assets and funds.

No matter how cautious YOU are, you can't rely on another party to keep your seedphrase safe. That's what hardware wallets are for!

#SaferNFTs 9/10

TLDR;

- STEPN lets you recover an account inside the app by entering seedphrase
- Use BURNER wallets with 3rd party apps (if at all), WITHOUT assets in them
- DON'T trust 3rd party apps to keep your keys safe
- For your valuable assets, get a HARDWARE wallet✅

#SaferNFTs 10/10