Question on ganache about Address/Account generated

[AndyWaiHim]

Hi,

It is my first time asking a question on Github. Thank you in advance for all your valuable answers.

My question is : will the accounts generated with Ganache be deleted ?

To put in context, if I have understood correctly, Truffle is using a local development blockchain called Ganache. So everytime I enter "truffle develop" or "truffle test" in my terminal, Truffle is generating for me 10 new local accounts with their private key.

Truffle Develop started at http://127.0.0.1:9545/

Accounts:
(0) 0x81c2a65455fbf40608ba066f434b471e49200a94
(1) 0x58dffbd30c6147c5ca7572af691cc06e097dce30
(2) 0x84c0648391dba327a060e31f7adbad1b3932e1b4
(3) 0xb02aec749474ff9ca44e0dc9b27b683f2da91d01
(4) 0x0d2c037588d51fb487a599075b08bded8ed73b8c
(5) 0x5ef3ccb1355bc27f2a653a7df14709e80a0c7e76
(6) 0xd03d5db095f391661990710731a119800c18a37b
(7) 0x91acf4b8d67d8b044729c1455ecb35946415dce6
(8) 0x685b3658e14101ef28054730b7ea1d0281d716f5
(9) 0xfd1b2294588f119c5890c93959d107a71aea4b57

Most of the time, I don't even use most of them, so I thought that these accounts would be temporary and deleted. However, as I followed some youtube tutorial, I happened to deploy on Rinkeby a simple smart contract using one of the account. (using "truffle migrate --reset --network rinkeby") And now I am realizing that this account is on Rinkeby Etherscan forever.

https://rinkeby.etherscan.io/address/0x81c2a65455fbf40608ba066f434b471e49200a94
https://rinkeby.etherscan.io/address/0x92c6c09e33375189b3378ee8774274890cdb1556

I am very confused, I thought Ganache was only local, why the address worked on a public testnet ?

Can I really use a Ganache account to deploy on Mainnet ?
Is the only issue here is that the mnemonic is only 12 words, when most Ether accounts are generated with 24 words? Therefore, the account is not secure, but in our case, it was just used to deploy a smart contract and will never be funded, so security is not a big deal right ?

Thank you for reading

[MicaiahReid]

Hi @AndyWaiHim, excellent question! I agree that it can be confusing. I'll do my best to answer!

Ganache uses a twelve word mnemonic to generate 10 accounts on startup. These are valid Ethereum accounts, meaning that each generated account has a private key that can be used to sign transactions. When you are running truffle migrations on the Ganache network, Ganache verifies that the private key is valid for the account sending the transactions, and updates Ganache's VM state accordingly.

However, like I stated above, these are valid Ethereum accounts. Basically any 40-character hexadecimal string with "0x" in front of it is a valid address that can receive funds. If you want to waste some Rinkeby Ether and send some funds to any random address like 0x0101010101010101010101010101010101010101, that transaction will show up in Etherscan. In order to use that address, however, you'll need the valid private key for that address. So, since Ganache generates valid private key/public address pairs, those generated addresses can be used on mainnet and testnets if they are funded.

That being said, when you are ready to actually deploy a smart contract, we do not recommend using Ganache to generate your accounts. Use a wallet like MetaMask to generate the accounts and manage your private keys and use the Truffle Dashboard for deployment.

I hope that helps!

[AndyWaiHim]

Thank you very much @MicaiahReid, it does help and I have a better understanding.

If I have understand correctly, I can conclude that the 10 accounts will never be deleted and stay valid Ethereum accounts. (Edit : to be more accurate, the account are already in the Ethereum blockchain and Ganache just calculate the valid private key associated)
No one will be able to use these same public address again, except me, as I hold the private key. Ganache won't generate the same key pair again (Edit : Or maybe it does) and using the Metamask generation method can't produce these kind of key pair. (I suppose the Metamask method might produce more sophisticated key pair as it used 24 words mnemonic)

Thank you again.

[MicaiahReid]

@AndyWaiHim Your conclusions are spot on!

To add one more clarification on this:

Ganache won't generate the same key pair again (Edit : Or maybe it does)

We use the seedrandom library which should be "reasonably unpredictable" in generating accounts, so it statistically won't generate the same accounts twice. However, we don't attempt to protect the generated mnemonic or private keys. For example we plainly display the mnemonic and keys in the console on startup. Wallets like MetaMask, however, are very good at security and privacy, so we leave that to the pros :)

Thanks for the question!