cryptoadvance / cryptoadvance/specter-diy

Annoying attack on segwit transactions

Open
#63 1 comment 0 reactions 0 assignees View on GitHub
security
Dominant language
Python
Stars
585
Forks
108
Avg merge
6d 1h
Merged PRs (30d)
5

Description

Attack:
https://blog.trezor.io/details-of-firmware-updates-for-trezor-one-version-1-9-1-and-trezor-model-t-version-2-3-1-1eba8f60f2dd

We need to either show `fee:unknown` if `non_witness_utxo` is not present in PSBT, or store tx history and show a warning if we see the same txid with a different amount.

If `non_witness_utxo` is present we need to check it and optionally convert it to `witness_utxo` for signing.

PSBT implementation was ignoring `non_witness_utxo` because we didn't support legacy transactions. Now we need to add support for them and also properly sign witness transactions when `non_witness_utxo` is provided.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.