LedgerHQ / ledgerjs

⛔️ MOVED to monorepo "ledger-live"
https://github.com/LedgerHQ/ledger-live
Apache License 2.0
575 stars 377 forks source link

getWalletPublicKey with {verify:true} throws UNKNOWN_ERROR for non-standard paths #799

Open landabaso opened 2 years ago

landabaso commented 2 years ago

Try to get an address from a non-standard path:

import Transport from '@ledgerhq/hw-transport-webusb';
import AppBtc from '@ledgerhq/hw-app-btc';
const btc = new AppBtc(transport);

const { bitcoinAddress } = await btc.getWalletPublicKey(
  "199'/0'/1'/0/88'",
  {
    verify: true
  }
);

This will throw this error:

TransportStatusError {name: 'TransportStatusError', message: 'Ledger device: UNKNOWN_ERROR (0x6a82)', stack: 'Error\n    at new TransportStatusError (https://loc… (https://localhost:3443/dist/bundle.js:13491:58)', statusCode: 27266, statusText: 'UNKNOWN_ERROR'}

It will not fail when using verify: false. But it will show the following WARNING asking to use verify: true. Note I used one of the paths (M/199'/0'/1'/0/88) in the WARNING in my example.

Btc.js:143 WARNING: Using deprecated device protocol to get the public key because

        * a non-standard path is requested, and
        * verify flag is false

        The new protocol only allows export of non-standard paths if the 
        verify flag is true. Standard paths are (currently):

        M/44'/(1|0)'/X'
        M/49'/(1|0)'/X'
        M/84'/(1|0)'/X'
        M/86'/(1|0)'/X'
        M/48'/(1|0)'/X'/Y'

        followed by "", "(0|1)", or "(0|1)/b", where a and b are 
        non-hardened. For example, the following paths are standard

        M/48'/1'/99'/7'
        M/86'/1'/99'/0
        M/48'/0'/99'/7'/1/17

        The following paths are non-standard

        M/48'/0'/99'           // Not deepest hardened path
        M/48'/0'/99'/7'/1/17/2 // Too many non-hardened derivation steps
        M/199'/0'/1'/0/88      // Not a known purpose 199
        M/86'/1'/99'/2         // Change path item must be 0 or 1

        This compatibility safeguard will be removed in the future.
        Please consider calling Btc.getWalletXpub() instead.

I'm using latest versions of Ledger app and JS libs. Ledger Nano Bitcoin app Version 2.0.2 And


    "@ledgerhq/hw-app-btc": "^6.24.1",
    "@ledgerhq/hw-transport-webusb": "^6.24.1",

BTW, what does verify do? I could not find it in the documentation. Should it ask the user to confirm that this is not a standard address on the device?

Or is it trying to deliberately verify that this is a standard path? And if not then throw an error. If this is the case, then I'd suggest to document it and throw something that it is not UNKNOWN perhaps.

Thanks!