Monzero BIP39 seeds: one phrase, the same keys as Monero

BIP39 is the standard for the word-list recovery phrases most Bitcoin wallets use. Monero's classic seed is a different thing, 25 words long, but Cake Wallet also lets a Monero wallet be made from a BIP39 phrase. The sixth commit of the Monzero patch gives Monzero exactly the same code: the file that does it, bip39_seed.dart, and its test are copies of Cake Wallet's Monero ones. A new Monzero wallet can be made with a BIP39 phrase, and a 12-, 18- or 24-word phrase can be restored; a 12-word phrase switches the restore form to BIP39 and then asks for a restore height.

How a phrase becomes a Monzero wallet

The phrase, with its passphrase if there is one, becomes a BIP39 seed. The seed goes through BIP32 key derivation on the secp256k1 curve to the path m/44'/128'/0'/0/0, where the third figure is the account. The private key at the end of that path is reduced modulo the order of the ed25519 group and becomes the spend key of a classic 25-word seed. From there on the wallet is an ordinary Monero-style wallet. The app keeps the BIP39 phrase and the passphrase in the wallet's cache, so that it can show the phrase back when asked for the seed.

Why the keys are Monero's

In that path, 128 is Monero's coin type in SLIP-0044, the registry that gives each coin its own number so that one phrase yields different keys for each. Monzero has no number of its own, and the patch keeps 128 on purpose, so that a phrase works wherever Monero's BIP39 derivation does. The pull request text states the consequence plainly: one phrase gives the same 25-word seed, and so the same keys, on Monero and on Monzero.

The same is true of a classic 25-word Monero seed, since Monzero uses Monero's word lists and derives its keys from them in the same way. The patch's tests depend on it. They restore Cake Wallet's own Monero test phrases as Monzero wallets and expect Monero's test addresses back, re-encoded for Monzero: decode the address, change the network prefix from 18 to 86, recompute the Keccak checksum.

What that means

One address gives the other away. A Monero address and a Monzero address made from the same phrase carry the same two public keys; only the prefix and the checksum differ. Anyone who has one can compute the other, exactly as the test does, and tie the Monzero wallet to the Monero one.

One secret guards both. Whoever learns the phrase controls the funds on both networks. Typing a Monero phrase into Monzero software puts the Monero funds behind software that, by Monzero's own README, has not been independently audited.

Monzero says not to. Its README asks users never to reuse a Monero wallet file, private key or recovery seed with Monzero, and not to import a seed used on another CryptoNote-derived network.

So the safe way to use the feature is the way it was built to be used: a new phrase for a Monzero wallet, written down and kept for that wallet alone. What the shared derivation buys is portability — a Monzero phrase made this way can be restored by any Monzero wallet that derives BIP39 the way Monero wallets do — not a licence to reuse a Monero phrase.

A BIP39 passphrase does change the keys; the tests check that it changes the address. It does not separate the two wallets, though. The phrase itself still has to be typed into the Monzero app, and a Monero wallet made from that phrase without a passphrase is open to whoever learns it.

Wallet groups

Cake Wallet can group the wallets of several coins that share one seed. The patch counts Monzero as a BIP39 coin, so a Monzero wallet can join a group with a BIP39 seed — and a Monero wallet in the same group, made from the same phrase on the same path, has the same keys. Wallet groups are on the pull request's list of what has not been tested.

A bug the tests caught

Restoring from a seed, as copied from the Wownero code, also cached the derived 25-word seed under the name the app reads first. A BIP39 wallet therefore showed its 25-word seed instead of the phrase it was made from. The nine new tests of the wallet service, modelled on Cake Wallet's Monero tests, caught it: three of the nine failed before the fix. Now only the passphrase is cached there, as in the Monero code. The build guide has the rest of the tests.