Blockstream / Blockstream/green_android
2-of-3 multisig with 2FA: Show service xpub (per-account) for faster recovery
- Dominant language
- Kotlin
- Stars
- 268
- Forks
- 106
- PR merge metrics
- No merged PRs in 30d
Description
In the Blockstream app, when creating a 2-of-3 wallet with 2FA enabled, the resulting wallet does not display the xpub for the 2-of-3 account after account creation.
This xpub is required for restoring/recovering the wallet using the garecovery tool: https://github.com/Blockstream/garecovery
I found this documented via: https://help.blockstream.com/blockstream-app/manage-2fa-accounts/2fa-multisig-protection-explained
After creation, there appears to be no way to retrieve or view that xpub within the app.
Steps to Reproduce
Open the Blockstream app.
Create a new wallet configured as 2-of-3 with 2FA enabled.
Complete account creation (no xpub is displayed).
Log in again and open the wallet/account options:
Select the 2-of-3 account → 3 dots → Watch-only
Observe that watch-only credentials (email and password) can be updated or deleted.
Expected Result
The app should show the xpub (or provide an option to export/retrieve it) for the 2-of-3 + 2FA account, and clearly warn that the xpub is important to keep in order to restore the wallet using garecovery.
Actual Result
For 2-of-3 with 2FA, the app does not display the xpub. The watch-only flow is limited to managing email/password credentials, and I do not see any way to obtain the xpub required for garecovery.
Additionally, when using a Jade HW for multisig with third parties (e.g., via Sparrow), the xpub is registered on the hardware device itself under its options → wallet → registered wallets area. However, this does not appear to be the case when creating a 2-of-3 + 2FA multisig using the Blockstream app.
Contributor guide
Assessment
This issue has not been assessed yet.