Skip to content

Conversation

fakela
Copy link
Contributor

@fakela fakela commented Oct 7, 2025

Closes #587
Closes #137

There is a missing link to the how to get testnet section. It might be added now or once the #599 is merged.

@fakela fakela requested a review from a team as a code owner October 7, 2025 02:10

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

Copy link

github-actions bot commented Oct 7, 2025

Thanks for the Tonkeeper doc update — I focused on the single changed page and found several high‑severity safety and correctness items to address before merge.

Findings (6)

High (6)

[HIGH] Missing safety callout for mnemonic handling

Location:

<Tip>The recovery phrase is the only way to restore access to your wallet if the app is deleted or your device is lost. Make sure to save it in a secure place.</Tip>

Description:
The recovery phrase guidance is presented as a Tip, but mnemonic handling is safety‑critical. Instructions that risk exposing private keys require a Warning with explicit risk and irreversibility. The current phrasing underplays the risk of account takeover and permanent loss.

Suggestion:
Replace the Tip with a Warning that states the risk and irreversibility.

-<Tip>The recovery phrase is the only way to restore access to your wallet if the app is deleted or your device is lost. Make sure to save it in a secure place.</Tip>
+<Warning title="Keys and funds at risk">
+Losing or exposing your 24-word recovery phrase allows account takeover and permanent loss of funds. Store it offline in a secure place. Rollback: none — access cannot be restored without the exact phrase.
+</Warning>

[HIGH] Missing safety callout for entering mnemonic

Location:

3. Enter your 24-word mnemonic

Description:
Step 3 instructs users to enter a 24‑word mnemonic without a required safety callout. Actions that expose private keys or mnemonics must include a Warning stating risk, scope, mitigation, and an environment label. The nearby Tip at L41 does not satisfy these requirements.

Suggestion:
Insert a Warning before the testnet account steps with the required elements.

 Tonkeeper requires a mainnet wallet before creating a testnet account. The testnet account derives from your existing wallet's [mnemonic](link-to-mnemonic-article).
+
+ <Aside type="warning" title="Secrets at risk — mnemonic">
+ Entering your 24-word recovery phrase exposes sensitive wallet keys.
+ Scope: your wallet and any derived accounts. Mitigation: enter the mnemonic only on trusted devices; do not store it in plaintext or share it. Environment: use TON Testnet for testing; avoid using a mainnet mnemonic outside your wallet app.
+ </Aside>
 
 To add a testnet account:

[HIGH] Missing safety callout for funds transfer

Location:

1. Open Tonkeeper and tap **Send**
2. Enter a recipient address (for testing, you may send to yourself)
3. Specify the amount
4. Confirm the transaction with your PIN

Description:
The deployment procedure requires sending a transaction that moves funds without a required Warning. This must state risk, scope, mitigation, and an environment label so readers understand finality and how to mitigate risk.

Suggestion:
Add a Warning immediately before the numbered deployment steps.

 Once you have coins in your wallet:
+
+ <Aside type="warning" title="Funds at risk — use testnet">
+ Sending a transaction moves funds and is irreversible.
+ Scope: the selected wallet/account. Mitigation: test on TON Testnet first; verify the recipient and amount before confirming. Environment: prefer testnet; on mainnet, transfers are final and cannot be rolled back.
+ </Aside>
 
 1. Open Tonkeeper and tap **Send**

[HIGH] Missing safety callout for NFT transfers (irreversible action)

Location:

## Transfer NFTs
To send an NFT to another person:
1. In Tonkeeper, go to the **Collectibles** tab
2. Browse your collection and choose the specific NFT you want to send, then tap **Transfer**
3. Enter the recipient's wallet address or domain (like TON DNS), write a comment if needed, and tap **Continue**
4. Follow the prompts to confirm the transaction
Always double-check all the transaction information. Once the transaction is complete, you cannot undo it. Once confirmed, the NFT will be transferred to the recipient's wallet.

Description:
The NFT transfer section uses a generic caution sentence but lacks a formal Warning. NFT transfers are on‑chain and irreversible; guidance must highlight finality and verification steps explicitly.

Suggestion:
Replace the free‑form caution with a Warning.

-Always double-check all the transaction information. Once the transaction is complete, you cannot undo it. Once confirmed, the NFT will be transferred to the recipient's wallet.
+<Warning title="Transfers are final">
+NFT transfers on TON Mainnet are irreversible. Verify the recipient address and collection details before confirming. Test on TON Testnet first if possible. Rollback: none — on-chain transfers are final.
+</Warning>

[HIGH] Broken image paths to non-existent subfolder

Location:

<img
src="/resources/images/tonkeeper/Tonkeeper.png"
alt="Main dashboard interface"
height="300"
className="rounded-lg"
/>

Description:
Image tags reference /resources/images/tonkeeper/, which does not exist. The repo contains resources/images/Tonkeeper.png at the root of images. Additional occurrences at L43–L48 (backup.png) and L60–L65 (testnet-account.jpg) also point to the non‑existent subfolder and will not resolve.

Suggestion:
Point the first image to the existing asset and temporarily use the same asset as a placeholder for the other two until correct images are added.

-<img 
-  src="/resources/images/tonkeeper/Tonkeeper.png" 
+<img 
+  src="/resources/images/Tonkeeper.png" 
   alt="Main dashboard interface"
   height="300"
   className="rounded-lg"
 />
-<img 
-  src="/resources/images/tonkeeper/backup.png" 
-  alt="Backup recovery phrase"
+<img 
+  src="/resources/images/Tonkeeper.png" 
+  alt="Tonkeeper screenshot (placeholder)"
   height="50%"
   className="rounded-lg"
 />
-<img 
-  src="/resources/images/tonkeeper/testnet-account.jpg" 
-  alt="Add Testnet Account"
+<img 
+  src="/resources/images/Tonkeeper.png" 
+  alt="Tonkeeper screenshot (placeholder)"
   height="300"
   className="rounded-lg"
 />

[HIGH] Placeholder/broken links for mnemonic and faucet

Location:

Tonkeeper requires a mainnet wallet before creating a testnet account. The testnet account derives from your existing wallet's [mnemonic](link-to-mnemonic-article).

Description:
The page uses placeholder links that will render as broken: [mnemonic](link-to-mnemonic-article) at L52, [TON testnet faucet](link-to-testnet-coins-guide) at L71, and “How to get testnet coins” at L95. These prevent readers from reaching the referenced material.

Suggestion:
Replace placeholders with working internal/external links.

-Tonkeeper requires a mainnet wallet before creating a testnet account. The testnet account derives from your existing wallet's [mnemonic](link-to-mnemonic-article).
+Tonkeeper requires a mainnet wallet before creating a testnet account. The testnet account derives from your existing wallet's [mnemonics](/standard/wallets/mnemonics).
-To deploy your wallet, you need TON. For testnet, you can request free coins from the [TON testnet faucet](link-to-testnet-coins-guide).
+To deploy your wallet, you need TON. For testnet, request free coins from the [TON testnet faucet](https://t.me/testgiver_ton_bot).
-- [How to get testnet coins](link-to-testnet-coins-guide)
+- [How to get testnet coins](https://t.me/testgiver_ton_bot)

@fakela fakela self-assigned this Oct 7, 2025
@anton-trunov
Copy link
Member

Copy link
Member

@anton-trunov anton-trunov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

let's fix the in-place comments and the relevant AI comments too


Once the transaction is confirmed, your wallet contract will be deployed on-chain and become active. You can verify this by checking your wallet address on the [Testnet explorer](https://testnet.tonscan.org/).

## Transfer NFTs
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why only NFTs? what about jettons?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also, the description needs to have illustrations for each step

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I recommend covering the Traces-related explanation in the corresponding assets (NFTs, Jettons). For example, we have a jetton section; let's explain how transfer works there with screenshots of Tonviewer or even self-drawn images.

Additionally, it will be more useful for those who want to understand how asset transfer works at a high level and how to track this in explorers.

Reason: Different wallets will display varying information, which may change monthly, and we can't guarantee that the information is up-to-date here.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

This comment was marked as outdated.

Copy link

github-actions bot commented Oct 9, 2025

To fix the formatting issues:

  1. Install necessary dependencies: npm ci
  2. Then, run this command:
npx remark -o --silent --silently-ignore ecosystem/wallet-apps/tonkeeper.mdx 

@tact-lang tact-lang deleted a comment from github-actions bot Oct 9, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Ecosystem > Wallet apps] Check NFT transfer is described [Ecosystem > Wallet apps > Using Tonkeeper]
4 participants