Blockstream / Blockstream/Jade

Connected ESP-32 device masquerades as a Jade in Sparrow / wallet software

Open
#226 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
496
Forks
127
PR merge metrics
No merged PRs in 30d

Description

From https://github.com/sparrowwallet/sparrow/issues/1688:

> Went to make a transaction with my hardware wallet and when I got to the signing process, I was surprised, and suspicious to discover there was (also) a Jade signer recognized by Sparrow. I don't own a Jade hardware wallet, and the error log that showed up when it automatically tried to sign the transaction contained a bunch of serial output related to Bitcoin mining. Took some time to realize that my ESP-32 devices running [NerdMiner](https://github.com/BitMaker-hub/NerdMiner_v2) were to blame, but not before cancelling the transaction out of suspicion.
>
> Pretty sure Jade is built on an ESP-32 board, but would it be possible to tighten up the device identification such that any old ESP-32 board doesn't get picked up as a Jade hardware wallet by Sparrow?
>
> Obviously a strange developer-level corner case, but caused enough suspicion I'd been hacked to warrant report the condition.

And from @craigraw's response:

> Identification is done through USB vendor and product IDs which are unchanged from the ESP32 default. In addition, there are DIY Jades which use ESP32 boards, so it's not even a Blockstream thing. The Jade API itself is not particularly robust either, so rejecting devices based on their initial response will probably do as much harm as good (see https://github.com/sparrowwallet/sparrow/issues/1616 for details).
>
> I don't like it either, but I think this is a Jade problem without resolution at this level. It may be worth reporting to Blockstream.

Would it be possible to enhance the Jade API such that normal ESP-32 devices connected to a system aren't assumed to be Jades?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.