sparrowwallet / sparrow

Desktop Bitcoin Wallet focused on security and privacy. Free and open source.
https://sparrowwallet.com/
Apache License 2.0
1.28k stars 180 forks source link

The xpub QR code scanner doesn't accept [mfp/path]xpub codes #653

Closed eliasnaur closed 2 years ago

eliasnaur commented 2 years ago

To reproduce (Sparrow 1.6.6):

  1. Create a new wallet.
  2. Under "Keystore1" click "xPub/Watch only wallet"
  3. Click on the camera icon to right of the xpub text field.
  4. Scan an xpub with master fingerprint and derivation path included. Example: [14914ca1/84'/0'/0']xpub6D8GhVqPZZLwNxvGGfni9NqE81w8TYWVLaZfspRmchYFmWahbGFqc8vDTQgTESsFPZvnXJe9ykv3tF6SkoGj573TpBAMKZzyowTizeGYHnN

I had expected Sparrow to accept the xpub, and fill out master fingerprint and derivation path. Instead, I got the error "Invalid QR code". To scan an xpub with mfp and path, I have to go to "Airgapped Hardware wallet" and then "SeedSigner Scan".

Curiously, the xpub QR scanner will accept a SeedQR (example: "085705080897034915841420160103740338017907651885") and fill out xpub/mfp/path. I'm not sure it's a good idea to accept private keys where public keys are expected.

craigraw commented 2 years ago

Indeed, QR codes with strings containing a fragment of an output descriptor do not follow any standard I'm aware of, even if they are used by SeedSigner. Originally in fact, this function was intended solely for scanning in xpubs (specified as text, or via the UR2.0 standard).

That said, Sparrow attempts to follow Postel's Law where it is practical to do so. I've made a change in 6534ccb0 so that output descriptor fragments are now accepted.

I'm not sure it's a good idea to accept private keys where public keys are expected.

Again, this follows Postel's Law.