# Wallet name with ':' corrupts file format, persistent panic on every startup

**URL:** https://ghostforum.org/t/wallet-name-with-corrupts-file-format-persistent-panic-on-every-startup/144
**Category:** Submitted
**Tags:** ghost-eye
**Created:** [October 5, 2026, 2:44am UTC](https://ghostforum.org/t/wallet-name-with-corrupts-file-format-persistent-panic-on-every-startup/144 "2026-10-05T02:44:24Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Rusdiwireng](https://ghostforum.org/letter_avatar_proxy/v4/letter/r/9de0a6/32.png) [@Rusdiwireng](https://ghostforum.org/u/Rusdiwireng)
#### Post date: [October 5, 2026, 2:44am UTC](https://ghostforum.org/t/wallet-name-with-corrupts-file-format-persistent-panic-on-every-startup/144/1 "2026-10-05T02:44:24Z")

</div>

**Component:** `ghost-eye` @ `ee23e6b`, `src/components/wallet/add_account.rs` + `rename_account.rs` (no name validation), `src/components/wallet/accounts.rs:228-233` (write) and `:236-252` (read).

**Description:** The `wallet-keys` storage format is `name:0x<seed-hex>` per line, parsed with `line.find(":")`. Wallet names are not validated on add/rename (grep for character validation in `add_account.rs`/`rename_account.rs` = empty). If a name contains `:`, parsing on the next startup takes the wrong seed slice → `hex::decode` fails → `.expect(...)` panics → the app crashes every time it opens until the file is edited manually.

**Impact:** Persistent local DoS of the TUI (self-inflicted; user must hand-edit the file to recover). No privilege escalation or fund loss.

**Reproduction:** Read `accounts.rs:236-252`; replicate the parse logic in a local unit test with input `name:with:colon:0x<seed>` → `hex::decode` gets the wrong slice → panic on `.expect` (parse PoC verified by the team).

**Severity: Low.** Reason: triggered by the user’s own input (or social engineering to get the user to name a wallet with `:`); impact is local availability only; trivial fix.

**Recommendation:** Validate wallet names (reject `:` and newlines) on add/rename; switch the file format to JSON/CSV with escaping; replace `.expect` on file read with error handling that skips bad lines + logs a warning.

**Verification:** VERIFIED.