0

Scenario: (2 of 3 multisig) one of the hardware wallets is running malware and uses an attackers xpub instead of the one derived from the recovery phrase. This swapped xpub is reported to all the other cosigners and the software wallet. All signing devices corroborate that they are all using the same set of xpubs, and that their respective sets of receive addresses match those displayed on the software wallet. But the funds sent to these addresses do not belong to the owner, as their redeem scripts were created using an xpub the owner does not have knowledge of.

If the owner were to wipe the devices and recover their multisig setup on a new set of devices free of malware, they would be shown a completely different wallet with empty addresses. In order to recover their funds they would need the missing xpub from the previously malware infected hardware wallet.

Question: If this scenario is possible, isn't multisig actually less secure than single sig, since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?

Improve this question
2
  • How does "all signing devices corroborate that they are all using the same set of xpubs" ?
    – Saxtheowl
    Commented Apr 19, 2023 at 10:46
  • 1
    What I meant by that was all devices (assuming they have the feature) display their own xpub as well as the cosigners xpubs. After checking all three devices you see that the same three xpubs have been displayed on each device.
    – chaulmianmints
    Commented Apr 21, 2023 at 3:26

2 Answers 2

Reset to default
3

since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?

This is not correct.

Yes, all the xpubs need to be known at signing time to (re)construct the full redeemscript. But the xpubs are not secret, so they can be backed up in several places without increasing security risk. It suffices if just one of the signers has access to the correct xpubs, since that one signer can inform the others. In fact, these xpubs don't even need to be (just) stored on the hardware devices, they can be backed up independently, and typically are.

Improve this answer
3
  • My concern is not with losing xpub backups, but with obtaining a valid xpub in the first place. As far as I can tell, there is nothing inherent to multisig setups that guarantee the displayed xpubs were derived from your seed phrase. The only way to gain confidence is to reproduce them on separate device, or with a mnemonic converter. In a single sig setup this is also true, but since with multisig there can be three devices with this issue instead of one, in this respect multisig is more vulnerable. But maybe malware on a hardware wallet swapping its xpub doesn't make sense in practice?
    – chaulmianmints
    Commented Apr 20, 2023 at 4:10
  • 1
    @chaulmianmints You only need your treshold to be honest in this regard. E.g. in a 2-of-3 setup, it's fine if one device gives an incorrect xpub, as you'll never need a signature with it. It's true that changing the xpub after setup will make funds unspendable, but that just means you need to use the same xpub at address generation time and at spending time; it doesn't matter whether that xpub can actually be signed for.
    – Pieter Wuille
    Commented Apr 20, 2023 at 11:37
  • 1
    Oh duh! It doesn't matter that one of the xpubs was created using an attacker controlled recovery seed, so long as I have all of the xpubs backed up. I can still reproduce the addresses, because I know all the xpubs that were used to created them. And it doesn't matter that I don't have the xpriv from the attacker's recovery phrase, because I still have control of 2 of 3 xprivs.
    – chaulmianmints
    Commented Apr 21, 2023 at 2:58
2

It will always be the case that the more parties that are involved in a transaction, the greater the attack surface.

This is true of the universe generally and is not Bitcoin specific.

You cannot conclude that multisig is less secure than single-signature unless you know that all other factors in the specific scenario are not favourable to multisig.

You have to take into account whatever factors cause participants to need a multisignature transaction and how that compares with the security of any alternative process - perhaps an unsecured compound process involving several single-signature transactions.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.