Yesterday Trezor released details of a segwit-related hardware wallet vulnerability.
The writeup claims that providing full previous transactions to the hardware wallet prevents the exploit.
My question: Why can't the compromised desktop software provide fake previous transactions corresponding to the fake inputs?
Using the example in the writeup:
- In "step 2", create a fake transaction containing an output spent by "input 2" with value 5.00000001 BTC and same outpoint as the 20BTC UTXO.
- In "step 5", create a fake transaction containing an output spent by "input 1" with value 0.00000001 BTC and same outpoint as the 15BTC UTXO.
The offline signer couldn't know that these fake transactions aren't on the blockchain. Most hardware wallets don't show information about the UTXOs being consumed so the user couldn't catch it by inspection. Does the fix involve incompatible sighash values for the two rounds?