Exported PSBT contains incorrect xpubs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 8.6k
- Forks
- 3.5k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 61
Description
To reproduce, create a 2-of-2 testnet multisig using those two xpubs:
Upub5RaFSZW1prRwC9QvRA7uvcNWR7G4nvh7g1kxt8dufx9q1c97XqAJnnJPFjPAQKQcXhgMLLTPErXgnpjifqbPo8115zifKUtojX8FoJPaUAA
Upub5QRV75dkgFc7vLcnBRM35KYAWhU9vzhwvPX8sNKSXc7bNNZCkKRCVbpvpiydDAfiTvsobsvcG1nwxP3Z7YymjE6qGLwB96njTDA3gpQG6HD
Note that both xpubs have a depth of 3, and a non-zero parent fingerprint and child_num:
Upub5RaFSZW1prRwC9QvRA7uvcNWR7G4nvh7g1kxt8dufx9q1c97XqAJnnJPFjPAQKQcXhgMLLTPErXgnpjifqbPo8115zifKUtojX8FoJPaUAA
depth: "\003"
parent_fingerprint: "\316\332\267\226"
child_num: 2147483648
chain_code: "@\322\021\371$\365Ze\232\333\216)T\215\376\\a\225\363\033\360\277\377\355)\330\036j\363\355\\\344"
public_key: "\003+\213DdE\033OeK\226\035\r\005\336\203\310\030$\213m\017@\303\212\244\003\013SX.-n"
Upub5QRV75dkgFc7vLcnBRM35KYAWhU9vzhwvPX8sNKSXc7bNNZCkKRCVbpvpiydDAfiTvsobsvcG1nwxP3Z7YymjE6qGLwB96njTDA3gpQG6HD
depth: "\003"
parent_fingerprint: "2>\232`"
child_num: 2147483648
chain_code: "\024\257\273/\\(\247\357(\'\321I\243\007\367\254\021\202k\360{\350F\330C:\337\236\341@/&"
public_key: "\002\244c\006\273RC\355lh\205~\252\007\nE\326\312\212S\026\373d\3537\230\204gn\202YU\236"
If you create an arbitrary transaction, finalize it and click 'Export -> for hardware device; include xpubs`, the exported PSBT contains the two xpubs, but the depth, fingerprint and child_num erased to zero.
This poses a problem to the BitBox02, as the BitBox02 registers the multisig in the device based on the full xpubs. When exporting this transaction and loading it later for to sign it, the registration is not recognized, as the xpubs are different. The xpubs in the PSBT are:
{BIP32Node(xtype='p2wsh-p2sh', eckey=<ECPubkey 032b8b4464451b4f654b961d0d05de83c818248b6d0f40c38aa4030b53582e2d6e>, chaincode=b'@\xd2\x11\xf9$\xf5Ze\x9a\xdb\x8e)T\x8d\xfe\\a\x95\xf3\x1b\xf0\xbf\xff\xed)\xd8\x1ej\xf3\xed\\\xe4', depth=0, fingerprint=b'\x00\x00\x00\x00', child_number=b'\x00\x00\x00\x00'): (b'i\xa4\xa6\x18', []), BIP32Node(xtype='p2wsh-p2sh', eckey=<ECPubkey 02a46306bb5243ed6c68857eaa070a45d6ca8a5316fb64eb379884676e8259559e>, chaincode=b"\x14\xaf\xbb/\\(\xa7\xef('\xd1I\xa3\x07\xf7\xac\x11\x82k\xf0{\xe8F\xd8C:\xdf\x9e\xe1@/&", depth=0, fingerprint=b'\x00\x00\x00\x00', child_number=b'\x00\x00\x00\x00'): (b'c#\x9f\x13', [])}
In both, the parent fingerprint,depth and child_num are wrong (all zeroes).
If one keystore is added from a HW wallet, and the other is added as an xpub, then only the xpub-based one has this problem.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue by creating the described 2-of-2 testnet multisig, exporting a finalized transaction for a hardware device with xpubs included, and inspecting the exported PSBT. Trace the export path from that action; done means the xpub depth, parent fingerprint, and child_num remain unchanged and the BitBox02 recognizes the multisig when the PSBT is loaded later.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- blockchain
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100