Blockstream / Blockstream/Jade
Connected ESP-32 device masquerades as a Jade in Sparrow / wallet software
- Dominant language
- C
- Stars
- 496
- Forks
- 127
- PR merge metrics
- No merged PRs in 30d
Description
From https://github.com/sparrowwallet/sparrow/issues/1688:
> Went to make a transaction with my hardware wallet and when I got to the signing process, I was surprised, and suspicious to discover there was (also) a Jade signer recognized by Sparrow. I don't own a Jade hardware wallet, and the error log that showed up when it automatically tried to sign the transaction contained a bunch of serial output related to Bitcoin mining. Took some time to realize that my ESP-32 devices running [NerdMiner](https://github.com/BitMaker-hub/NerdMiner_v2) were to blame, but not before cancelling the transaction out of suspicion.
>
> Pretty sure Jade is built on an ESP-32 board, but would it be possible to tighten up the device identification such that any old ESP-32 board doesn't get picked up as a Jade hardware wallet by Sparrow?
>
> Obviously a strange developer-level corner case, but caused enough suspicion I'd been hacked to warrant report the condition.
And from @craigraw's response:
> Identification is done through USB vendor and product IDs which are unchanged from the ESP32 default. In addition, there are DIY Jades which use ESP32 boards, so it's not even a Blockstream thing. The Jade API itself is not particularly robust either, so rejecting devices based on their initial response will probably do as much harm as good (see https://github.com/sparrowwallet/sparrow/issues/1616 for details).
>
> I don't like it either, but I think this is a Jade problem without resolution at this level. It may be worth reporting to Blockstream.
Would it be possible to enhance the Jade API such that normal ESP-32 devices connected to a system aren't assumed to be Jades?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.