spesmilo / electrum

Electrum Bitcoin Wallet
https://electrum.org
MIT License
7.36k stars 3.07k forks source link

Multisig wallet setup needs better UX #6456

Open fresheneesz opened 4 years ago

fresheneesz commented 4 years ago

Going through a multisig creation process is confusing with Electrum. For example, if you have 3 different devices you want to use to setup a multisig wallet, you may not be able to plug in all the wallets at once, so there should be some way to asynchronously set up a multisig wallet. However, electrum seems to assume that all the information is available right away all at once. It asks you to create a seed, gives the master public key, and then immediately asks for all the other master public keys. Well what if I don't have them yet?

It seems like Electrum is assuming that you'll have single-seed wallets that you can use the master public key for. Actually, it looks like you can't even do that, because trying to put in a zpub (instead of a Zpub) gives you the error "Wrong key type p2wpkh". If a user just wants to create a new multisig wallet, they're likely to just hit "create multisig wallet" and then get stuck one it asks for the master public keys for other devices.

There needs to be a better flow like the following:

  1. User begins creation of a new wallet,
  2. chooses multisig wallet and m of n,
  3. chooses seed location (eg connected hardware wallet, create seed on device, etc),
  4. chooses segwit vs legacy
  5. user writes down the seed

At this point the wallet should be created. You should be able to exit the app and return to it and select the multisig wallet you created. The interface should tell you the multisig wallet still needs master public keys to be set up and should provide a way for the user to enter them.

As it stands, if you don't have access to ALL the master public keys on creation of your multisig wallet, you can't even cancel the process or go back. Killing the app loses all your progress and you then have to go through the restoring process if you want to use the seed you created (and hopefully wrote down). This is pretty confusing for a user, and is incredibly inconvenient to the point of being unusable if there are multiple parties trying to create the multisig wallet and aren't doing it all at the same time (eg because they have a more secure process for backing up their seed than writing it on a piece of paper in full view of other people).

Another option, that might even be better than what I described above is to treat multisig wallets as extensions of single-seed wallets, where to create a multisig wallet you would start with a single-seed wallet, choose an option to create a multisig wallet which would ask for master public keys, then would open it as a separate wallet at that point. Similarly to access a multisig wallet, you would go into your single-seed wallet, and choose the multisig wallet within it. A single-seed wallet could even have multiple multisig wallets it is part of. The best way to create multisig wallets is to already have single-seed wallets you can get the master public keys of. Why not make this explicit and move multisig wallet creation as a subwallet of standard wallets?

fresheneesz commented 4 years ago

So continuing to actually go through this, its even worse. Mobile electrum has nowhere that displays its Zpub during the creation of the wallet. Also, any cosigner hardware wallet that isn't registered first will not show a master public key, which can get a user stuck on a mobile multisig wallet setup, since they won't

With that it makes creating the multisig wallet with a mobile wallet impossible with any reasonable workflow, because you can't get the public keys needed to enter into into the mobile wallet in order to get its Zpub key. This is pretty awful. The only workaround I can think of is to add other fake cosigners with keys generated on the desktop computer so you can create a wallet you don't want, get the Zpubs from that wallet, then restart and create the full multisig wallet once you have access to all the Zpubs.

This is not really a workable UI as it stands. Please let me know if you would like some mock ups of different UI and I can do that. I won't have time to actually look into building electrum and implementing for about a month probably.

fresheneesz commented 4 years ago

And I noticed that if you try to "use a master key" in the first step, it asks for an xpub or an xprv, and NOT a Zpub. Why??? Why is this asymmetric?

It looks like it does actually accept a Zpub, but doesn't mention that it can. Once you enter something, it shows it to you again as your master public key and tells you to "share it with your cosigners". That isn't an appropriate next step, since you are likely creating a watching only wallet, or at least a a wallet with only external cosigners.

relativisticelectron commented 4 years ago

It asks you to create a seed, gives the master public key, and then immediately asks for all the other master public keys. Well what if I don't have them yet?

The wallet cannot be created without the other master public keys. But I agree, some instructions would be helpful. E.g.:

If you don't have the other master public keys yet, please leave this electrum open, open electrum additionally and create the remaining cosigner wallets giving you the necessary master public keys to continue.

ecdsa commented 4 years ago

I believe this commit caused the regression that breaks the display of Zpub on Kivy: fbc539e2cc

relativisticelectron commented 4 years ago

I believe this commit caused the regression that breaks the display of Zpub on Kivy: fbc539e

Sorry. This was an unintended side effect of fixing the back button issue. In the future I will try to test more. Thanks for fixing it.