QR code has very limited data capacity. (According to Wikipedia) one single QR code can only carry <3KB of binary data.

It's not rare for a PSBT to hit this 3KB limit, especially for ones which spend non-SegWit UTXOs.

SegWit features signing of input values - on the other hand, signing non-SegWit inputs on offline/hardware wallet still requires full data of previous transactions to validate input values. Otherwise, it could be a security issue: a malicious party/malware could tamper the inputs stealthily to trick the user into paying an unexpected high amount.

  • A solution is not using QR codes for an inappropriate purpose. Find something else.
    – Claris
    Nov 11 '19 at 3:34
  • Use multiple QR codes
    – Andrew Chow
    Nov 11 '19 at 3:41
  • @AndrewChow Multiple QR codes seems to require something like sequence number/checksum etc, maybe fountain code would be better.
    – Chris Chen
    Nov 11 '19 at 6:50
  • @Anonymous I think at least QR code is better than USB, because I'm concerned about ADB. ADB has been "abused" by various companies, including both Android handset vendors and software vendors for quite a long time, they had turned ADB from a debugging interface into something for everyday use (as something similar to iTunes), thus countless users had already carelessly left ADB enabled.
    – Chris Chen
    Nov 11 '19 at 7:07
  • @AndrewChow I posted this question mainly because Electrum had implemented BIP174 in a deviated way: to make the PSBT fit in one single QR code, they allowed the insecure signing mentioned in this question. Since BIP174 is intended to be used across multiple wallet implementations, I think this is not an issue only limited to Electrum.
    – Chris Chen
    Dec 11 '19 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.