diff --git a/frontend/src/app/components/address/address.component.html b/frontend/src/app/components/address/address.component.html index f05caf371..f477e4dd7 100644 --- a/frontend/src/app/components/address/address.component.html +++ b/frontend/src/app/components/address/address.component.html @@ -1,4 +1,7 @@
+ @if (showColdcardWarning && !isLoadingAddress && !error) { + + }

Address

@@ -16,6 +19,7 @@
+
@@ -261,6 +265,13 @@
+ + + + Confidential diff --git a/frontend/src/app/components/address/address.component.scss b/frontend/src/app/components/address/address.component.scss index 06e15ad67..b2afeca9e 100644 --- a/frontend/src/app/components/address/address.component.scss +++ b/frontend/src/app/components/address/address.component.scss @@ -133,3 +133,17 @@ h1 { padding-bottom: 0; font-size: 0.8rem; } + + +.coldcard-warning { + display: flex; + align-items: center; + position: relative; + background-color: #b71c1c; + border-color: #b71c1c; +} + +.btn-close:hover, +.btn-close:focus { + opacity: 1; +} \ No newline at end of file diff --git a/frontend/src/app/components/address/address.component.ts b/frontend/src/app/components/address/address.component.ts index e11d7cfa4..b62977d7f 100644 --- a/frontend/src/app/components/address/address.component.ts +++ b/frontend/src/app/components/address/address.component.ts @@ -14,6 +14,7 @@ import { seoDescriptionNetwork } from '@app/shared/common.utils'; import { AddressInformation } from '@interfaces/node-api.interface'; import { AddressTypeInfo } from '@app/shared/address-utils'; import { extractTapLeaves, fillTapTree, convertTextToBuffer, PsbtKeyValue } from '@app/shared/transaction.utils'; +import { StorageService } from '@app/services/storage.service'; class AddressStats implements ChainStats { address: string; @@ -138,6 +139,8 @@ export class AddressComponent implements OnInit, OnDestroy { now = Date.now() / 1000; balancePeriod: 'all' | '1m' = 'all'; + showColdcardWarning: boolean = false; + private tempTransactions: Transaction[]; private timeTxIndexes: number[]; private lastTransactionTxId: string; @@ -151,6 +154,7 @@ export class AddressComponent implements OnInit, OnDestroy { private apiService: ApiService, private seoService: SeoService, private formBuilder: UntypedFormBuilder, + private storageService: StorageService, ) { } ngOnInit(): void { @@ -204,6 +208,7 @@ export class AddressComponent implements OnInit, OnDestroy { this.seoService.setTitle($localize`:@@address.component.browser-title:Address: ${this.addressString}:INTERPOLATION:`); this.seoService.setDescription($localize`:@@meta.description.bitcoin.address:See mempool transactions, confirmed transactions, balance, and more for ${this.stateService.network==='liquid'||this.stateService.network==='liquidtestnet'?'Liquid':'Bitcoin'}${seoDescriptionNetwork(this.stateService.network)} address ${this.addressString}:INTERPOLATION:.`); + this.showColdcardWarning = false; this.addressTypeInfo = new AddressTypeInfo(this.stateService.network || 'mainnet', this.addressString); return merge( @@ -337,6 +342,8 @@ export class AddressComponent implements OnInit, OnDestroy { } else { this.setBalancePeriod('1m'); } + + this.updateShowColdcardWarning(); }, (error) => { console.log(error); @@ -652,6 +659,29 @@ export class AddressComponent implements OnInit, OnDestroy { } } + updateShowColdcardWarning() { + const showCCWarningPref = this.storageService.getValue('showAddrColdcardWarning'); + + if (showCCWarningPref && showCCWarningPref === 'false') { + return; + } + + if (!['p2sh', 'v0_p2wsh', 'p2sh-p2wsh'].includes(this.addressTypeInfo.type) || !this.addressTypeInfo.isMultisig || this.addressTypeInfo.network !== 'mainnet') { + return; + } + + if (this.chainStats.balance === 0 && this.mempoolStats.balance === 0) { + return; + } + + this.showColdcardWarning = true; + } + + dismissWarning() { + this.storageService.setValue('showAddrColdcardWarning', 'false'); + this.showColdcardWarning = false; + } + ngOnDestroy(): void { this.mainSubscription.unsubscribe(); this.mempoolTxSubscription.unsubscribe(); diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.html b/frontend/src/app/components/transactions-list/transactions-list.component.html index 41633a0a7..1998ded2e 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.html +++ b/frontend/src/app/components/transactions-list/transactions-list.component.html @@ -21,6 +21,12 @@ Warning! This transaction involves deceptively similar addresses. It may be an address poisoning attack.
} + @if (showColdcardWarning) { + + }
diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.scss b/frontend/src/app/components/transactions-list/transactions-list.component.scss index 81b097c47..05269480b 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.scss +++ b/frontend/src/app/components/transactions-list/transactions-list.component.scss @@ -416,6 +416,19 @@ h2 { } } +.alert-danger { + display: flex; + align-items: center; + position: relative; + background-color: #b71c1c; + border-color: #b71c1c; +} + +.btn-close:hover, +.btn-close:focus { + opacity: 1; +} + @keyframes acceleratePulse { 0% { background-color: #653b9c; box-shadow: #ad7de57f 0px 0px 12px -2px; } 50% { background-color: #8457bb; box-shadow: #ad7de5 0px 0px 18px -2px;} diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.ts b/frontend/src/app/components/transactions-list/transactions-list.component.ts index 45659a5b6..a83b8dc18 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.ts +++ b/frontend/src/app/components/transactions-list/transactions-list.component.ts @@ -72,6 +72,7 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { showTaprootControlBlock: { [vinIndex: number]: boolean } = {}; showOrdData: { [key: string]: { show: boolean; inscriptions?: Inscription[]; runestone?: Runestone, runeInfo?: { [id: string]: { etching: Etching; txid: string; } }; } } = {}; similarityMatches: Map> = new Map(); + showColdcardWarning: boolean = false; selectedSig: { txIndex: number, vindex: number, sig: SigInfo } | null = null; sigHighlights: { vin: boolean[], vout: boolean[] } = { vin: [], vout: [] }; @@ -186,6 +187,7 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { }); this.updateAddressSimilarities(); + this.updateShowColdcardWarning(); } refreshPrice(): void { @@ -476,6 +478,33 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { } } + updateShowColdcardWarning(): void { + const showCCWarningPref = this.storageService.getValue('showTxColdcardWarning'); + // there's only one tx, it's the tx page, it's unconfirmed, it contains inputs that are p2sh, v0_p2wsh or p2sh-p2wsh, is multisig and network is mainnet + if (showCCWarningPref && showCCWarningPref === 'false') { + return; + } + + if (!this.transactionPage || this.txPreview) { + return; + } + + if (this.transactions.length > 1 || this.transactions[0].status.confirmed) { + return; + } + + const vinPossibleCC: Vin[] = this.transactions[0].vin.filter((input: Vin) => { + const addressTypeInfo = new AddressTypeInfo(this.network || 'mainnet', input.prevout.scriptpubkey_address, input.prevout?.scriptpubkey_type as AddressType, [input]); + return ['p2sh', 'v0_p2wsh', 'p2sh-p2wsh'].includes(addressTypeInfo.type) && !!addressTypeInfo.isMultisig && addressTypeInfo.network === 'mainnet'; + }); + + if (vinPossibleCC.length === 0) { + return; + } + + this.showColdcardWarning = true; + } + // assume any address with 12 or more contiguous repeated substrings is fake fakeScriptHashRegex = new RegExp(/(.+?)\1{11,}/); isFakeScripthash(vout: Vout): boolean { @@ -713,6 +742,12 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { } } + dismissWarning(): void { + this.storageService.setValue('showTxColdcardWarning', 'false'); + this.showColdcardWarning = false; + this.ref.markForCheck(); + } + ngOnDestroy(): void { this.outspendsSubscription.unsubscribe(); this.currencyChangeSubscription?.unsubscribe(); diff --git a/frontend/src/app/docs/api-docs/api-docs-data.ts b/frontend/src/app/docs/api-docs/api-docs-data.ts index 7544fd406..9a4baeab9 100644 --- a/frontend/src/app/docs/api-docs/api-docs-data.ts +++ b/frontend/src/app/docs/api-docs/api-docs-data.ts @@ -12938,6 +12938,13 @@ export const faqData = [ fragment: 'how-can-i-share-or-verify-taproot-scripts', title: 'How can I share or verify Taproot scripts?', }, + { + type: 'endpoint', + category: 'advanced', + showConditions: bitcoinNetworks, + fragment: 'why-may-my-multisig-funds-be-at-risk', + title: 'Why may my multisig wallet funds be at risk?', + }, { type: 'category', category: 'self-hosting', diff --git a/frontend/src/app/docs/api-docs/api-docs.component.html b/frontend/src/app/docs/api-docs/api-docs.component.html index 1eeb01f87..7be67000f 100644 --- a/frontend/src/app/docs/api-docs/api-docs.component.html +++ b/frontend/src/app/docs/api-docs/api-docs.component.html @@ -547,3 +547,9 @@

If you're getting errors when doing address lookups, it's probably because of your Electrum server backend.

Mempool uses an Electrum server to do address lookups. There are several implementations of the Electrum server protocol, and Mempool can use any of them, but the implementation you use affects performance:

  1. romanz/electrs. This is a common choice for its low resource requirements, and most full-node distros use it. But while this implementation works great for basic queries, it will struggle with heavier ones (e.g. looking up addresses with many transactions)—especially when running on low-power hardware like a Raspberry Pi.
  2. Fulcrum. Fulcrum requires more resources than romanz/electrs but it can still run on a Raspberry Pi, and it handles heavy queries much more efficiently. If you're having issues with romanz/electrs, Fulcrum is worth a try.
  3. mempool/electrs. If you have stronger hardware, you could consider running mempool/electrs, the backend that powers mempool.space. It's a fork of Blockstream's Esplora, which is in turn a fork of romanz/electrs, intended for maximum performance and larger-scale deployments.
 + + +

If a transaction reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a Coldcard with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds may be at elevated risk of theft while unconfirmed.

+

If an address has been used and reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a Coldcard with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds in the address are vulnerable.

+

See Coinkite’s advisory.

+