Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Stream full UTXOs for all types of inputs for Trezor #58

Open
tsusanka opened this issue Jun 17, 2020 · 0 comments
Open

Stream full UTXOs for all types of inputs for Trezor #58

tsusanka opened this issue Jun 17, 2020 · 0 comments

Comments

@tsusanka
Copy link

A security issue* in the design of BIP-143 allows an attacker to lie about segwit input amounts and get the user to pay an unexpectedly high transaction fee. The problem affects all HWW vendors.

We are fixing this by making Trezor require the full UTXO for all types of inputs, so we can validate that the input amount is correct. We have introduced this change in firmware versions 2.3.1 and 1.9.1.

*) Details in our blogpost: https://blog.trezor.io/details-of-firmware-updates-for-trezor-one-version-1-9-1-and-trezor-model-t-version-2-3-1-1eba8f60f2dd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant