New Bitcoin Recovery App failing to allow multisig wallet registration or signing

[logansease]

We are attempting to leverage the new Bitcoin Recovery App as a migration path to the new firmware which restricts unhardened paths.
We have taken several steps but are hitting significant issues.

1- wallet registration of a multisig wallet fails within the new Bitcoin Recovery app.
2- A device that has already completed wallet registration successfully on the previous firmware / app version fails to sign with the recovery app.

Below are the parameters that are being passed and the errors being returned.
Hopefully this can duplicate the issue within a unit test for quick resolution.

We greatly appreciate any help you can provide.

package.json: "ledger-bitcoin": "0.3.0",

Registration Failure

import * as ledgerBitcoin from 'ledger-bitcoin'
const transport = await getTransport()
const appClient = new ledgerBitcoin.AppClient(transport)

const multisigPolicy = new ledgerBitcoin.WalletPolicy(
   "Multisig-1", // policy name
   "sh(wsh(sortedmulti(2,@0/**,@1/**,@2/**)))", // descriptor template
  ["[22943817/49/0/0]xpub6C92h9BRnATnazSRWkRQw9sjy74FBvmNhEUJEu3dEgCfwVHiM7RNz2xtnywei4peFX2bqTjUce4vWXYsQyNMLgz4U7UtAwJjEdQzrXH8ktM", 
"[203ddff8/49/0/1]xpub6Ct76xvLRD17X9EavNLkRzLWVwaMQEQEn1qBRgdSE92i7eJ21ndRSC73sW9bdgwkE7xj5p4B7VtAwv2skdu52q66Yo4BVDxNjBqqTmZSc6F", 
"[71147f86/49/0/1]xpub6DJH6e3LkiBjqsmd7v11JF55h21RJSERdHC4Q1FNwf95sZjFLwtZ8xHkXYAEnK462rtfBD45MMhBn5MeMG2P5T7yfccYh8pfTnAGpsmdR"
] // keys
)

const [policyId, policyHmac] = await appClient.registerWallet(multisigPolicy)

result:

Transport.ts:277 Uncaught (in promise) TransportStatusError: Ledger device: UNKNOWN_ERROR (0x6a82)
    at TransportWebHID.send (Transport.ts:277:13)
    at async AppClient.makeRequest (appClient.ts:101:18)
    at async AppClient.registerWallet (appClient.ts:188:22)
    at async registerWalletPolicy (ledger.ts:411:1)
    at async Module.signingDevice_registerWalletPolicy (signingDevice.ts:18:1)

I'm on ledger nano S+ v1.5 running BTC recovery app 2.4.3

Signing Failure:

import * as ledgerBitcoin from 'ledger-bitcoin'
const appClient = new ledgerBitcoin.AppClient(transport)


   "Multisig-1", // policy name
   "sh(wsh(sortedmulti(2,@0/**,@1/**,@2/**)))", // descriptor template
  ["[22943817/49/0/0]xpub6C92h9BRnATnazSRWkRQw9sjy74FBvmNhEUJEu3dEgCfwVHiM7RNz2xtnywei4peFX2bqTjUce4vWXYsQyNMLgz4U7UtAwJjEdQzrXH8ktM", 
"[203ddff8/49/0/1]xpub6Ct76xvLRD17X9EavNLkRzLWVwaMQEQEn1qBRgdSE92i7eJ21ndRSC73sW9bdgwkE7xj5p4B7VtAwv2skdu52q66Yo4BVDxNjBqqTmZSc6F", 
"[71147f86/49/0/1]xpub6DJH6e3LkiBjqsmd7v11JF55h21RJSERdHC4Q1FNwf95sZjFLwtZ8xHkXYAEnK462rtfBD45MMhBn5MeMG2P5T7yfccYh8pfTnAGpsmdR"
] // keys
)

const walletPolicy = new ledgerBitcoin.WalletPolicy(
    "Multisig-0", // name
    "sh(wsh(sortedmulti(2,@0/**,@1/**,@2/**)))", // template
    [
        "[1b6531cf/49/0/0]xpub6C92h9BRnATnHMEMQ1885FWavHrDJ2buQmQusSFktV9XKgyC18JcSWFPPK7RtuqFWot4UHHHa4AF5BPV25ZMzYhDMBqBk2eaPv9djqN7Atw",
        "[6e35d0d2/49/0/0]xpub6CFfy1RWVBSqbQkPKNiY1eipHiZUs1f4JwvaiHrK7FNGRWVqhU2SdidHkCpUevSeSUpV3WnGRVMjhgt516Yjk64Hvt6Ka8rxPQ6t6WX4VG2",
        "[c7ef45fc/49/0/0]xpub6Cdpo8JKvjF7B3bjHmeCuoPnnM2G14NkD4QEdzf7y7q5xzHpHJXD1W1Qd5gqdQWU1AxDqsQcodVbqEW25W5nKCE7eNjN76HHGTtLiwjb25C"
    ] // keys
)

const walletHmac = ... // this is a data buffer with a bunch of bytes from a wallet registered with a previous firmware version

const psbt = "cHNidP8BAHMBAAAAAdkAOvrslpxXu+GJeJsReSGcmbEsBn7Nqa/JIYW7tv3FAQAAAAD9////AoQEAAAAAAAAF6kUZKS+37bMosSsSxKpswEsaZweE1yHyQkAAAAAAAAXqRTZYMbZGoT6h6lMGQ3CbzInkLtbBocAAAAATwEEiLIeA0JK130AAACzBDeBh3HWfdlqHGkvhrds4BLSGIdZCJGmDN7d6eVXxg8DmqNpOWxXTsxFY0vSurcI5noFI/a4jshBWKjnn4VhC7UQG2UxzzEAAAAAAAAAAAAAAE8BBIiyHgNR38KSAAAAAGF2XcdQq9aA1MDzTsbP5lSvwjP88lNGumk47pw0B/EqApyo3lnbvJUxFEa2UmnolhipdIyDS45zlWIzyY4FEwQOEG410NIxAAAAAAAAAAAAAABPAQSIsh4DhdY0kgAAAAA7j65Q8tZF0xp3H22eWmVO3IPLJ2hH11xb96jZ87E4nwMZwxaDMMWKMaLBaXEh4ug6aNYQBKqZjcvCOwk575DBLBDH70X8MQAAAAAAAAAAAAAAAAEA/ZUBAQAAAAABAc5x0EIitkTZ7oa3ItLZ2WT8WVqo3NrX4xKDB1p/zfYyAAAAACMiACCef5r4KDzBhMGJj4T0EZYIRxHGZboDpo5hVt6IkK1BtP3///8CDQkAAAAAAAAXqRSQO1ECuIjCfFprfslzStwciZCOvYdHEAAAAAAAABepFEUwU9QuI5Ye1SDDs3mjfchuy95KhwQARzBEAiArT4AFpeep9hLDF/z8PZZcjvJtNaPkd+mqg1h04pByBAIgLIKZ+6fknlccxbf1b3F+FxiGlEUQEHB96af54sDZ5nABSDBFAiEA9NkY2KpCvXrjeLA03LF5K6xOGJ1fek/uykHrjN8+uJ4CIDFFhWkJPDZOesFZ5enGUeF8eWA3h1p1td9nd1TB3+cgAWlSIQK5jMAJvgiv28tyg25MOeSxmmBO4UvAmqUV+aVUIeNyLSEDB4NIEVO5isYNNMNayytS93WxNFkExiK6PHegdN+Ue1khA250ZyWqJh+pmHhgLJi6dAcckZKaTW9H83JA/BaMvMNDU64AAAAAAQEgRxAAAAAAAAAXqRRFMFPULiOWHtUgw7N5o33IbsveSocBBCIAILIwyVFtj7xKqVjw9m8g4fVHTPYS+k9YmgwCuUPvRvG8AQVpUiEDxMUPhMzy4OVAQpkLWqQA2kJk7YmjL0qTNiJhhHiGngchA9TJxSLzffvMh3yZ2zgTRQoJkcpcj5pXcmUZO4lUQ4joIQPqB6ybbgDtgQwMu2UxmQDRabhIn29XkyB830yNggpYrlOuIgYDxMUPhMzy4OVAQpkLWqQA2kJk7YmjL0qTNiJhhHiGngcYx+9F/DEAAAAAAAAAAAAAAAEAAAAAAAAAIgYD1MnFIvN9+8yHfJnbOBNFCgmRylyPmldyZRk7iVRDiOgYbjXQ0jEAAAAAAAAAAAAAAAEAAAAAAAAAIgYD6gesm24A7YEMDLtlMZkA0Wm4SJ9vV5MgfN9MjYIKWK4YG2UxzzEAAAAAAAAAAAAAAAEAAAAAAAAAAAABAWlSIQK04XITWjbPgCHQ9WH0QNItN81T1Qw9aTDthy7fJm9K/yEDoTb9CqYbOHUONCwma5JHYXA0wTcFZqomW3A8ChD7LechA/YHmM+hCI5bo4QEeVoR91cHQBOt85rnIQRTNaLW9xaqU64iAgK04XITWjbPgCHQ9WH0QNItN81T1Qw9aTDthy7fJm9K/xgbZTHPMQAAAAAAAAAAAAAAAQAAAAEAAAAiAgOhNv0Kphs4dQ40LCZrkkdhcDTBNwVmqiZbcDwKEPst5xjH70X8MQAAAAAAAAAAAAAAAQAAAAEAAAAiAgP2B5jPoQiOW6OEBHlaEfdXB0ATrfOa5yEEUzWi1vcWqhhuNdDSMQAAAAAAAAAAAAAAAQAAAAEAAAAA"

await client.signPsbt(psbt, walletPolicy, walletHMAC, () => {})

Throws:

TransportStatusError: Ledger device: Invalid data received (0x6a80)
    at async AppClient.makeRequest (appClient.ts:101:18)
    at async AppClient.signPsbt (appClient.ts:327:5)
    at async signPsbt (ledger.ts:579:1)
    at async ledger_getSignedBitcoinTransaction (ledger.ts:281:1)
    at async Module.signTransaction (signingDevice.ts:108:1)
    at async run (react.ts:3:3)

[iartemov-ledger]

Hello @logansease ,

You said you have migrated from hw-app-btc to ledger-bitcoin 0.3.0, have not you?

It's just the call stack of the error above seems still to make reference to the paths and files of libraries of Ledger Wallet (Ledger Live) including hw-app-btc one.

[logansease]

Hey @iartemov-ledger yes that's correct. From what I see the libraries are extremely similar. You should see in my code snippet above that I am calling the appClient imported from the ledger-bitcoin library.
Can you clarify what you see in my call stack and code snippet that seems off and what you'd expecting to see? Thanks you for your assistance.

I ran a code analysis to see if there was anything I was missing and it seems to confirm what I see:

The stack trace clearly shows ledger-bitcoin, not hw-app-btc:
appClient.ts:101 → ledger-bitcoin's makeRequest
appClient.ts:327 → ledger-bitcoin's signPsbt
You can clarify:
> "The failing registration and signing calls go through ledger-bitcoin 0.3.0's AppClient and WalletPolicy classes as shown in the stack trace. The line numbers in the trace (appClient.ts:101, appClient.ts:327) match ledger-bitcoin's source, not hw-app-btc."

[logansease]

I've updated this ticket with code snippet and errors that occur during transaction signing with the recovery app as well. This happens with device that had previously performed a successful wallet registration in the older firmware.

[evansmj]

I am experiencing the same thing on my ledger nano s plus using the Bitcoin Recovery App to try to sign while using unhardened m/49/0/0. I also experienced this when sending APDU's to Speculos.

I created this demo repository that demonstrates this with two scripts. One script connects to a real ledger and another one uses Speculos.

https://github.com/evansmj/ledger-2-4-4-bitcoin-recovery-app-not-accepting-unhardened-derivation-paths

[iartemov-ledger]

Hello @evansmj ,

Thank you for your feedback and the scripts to reproduce.
We'll check all this.
In the meantime we've decided to rollback to previous v2.4.2, please see #396 (comment).

[logansease]

Thank you again @iartemov-ledger - just following up. Is there an option to rollback the eth app as well. With the ETH app, our users can use the eth recovery app, but the UX is not good. We sign on m/45'/.....

[iartemov-ledger]

Hello @logansease ,

No, the rollback for the ethereum app is not planned.
Eth Recovery app exists since quite a long time and it was for the recovery and migration, not for a permanent use.

[evansmj]

I've submitted a pr to fix the Bitcoin Recovery App not accepting all derivation paths. #408

[logansease]

@iartemov-ledger would you consider whitelisting 45'/* for the Eth app? or even 45'/60 and 45'/1 for eth and eth testnet.
These are the paths currently in use