Details of the Multisig Change Address Issue and its Mitigation

This article describes a security issue discovered in the firmware for Trezor Model T. We want to explain how an attacker could have exploited the issue and what measurements we took to close the attack vector. This problem affects only the Trezor Model T; Trezor One is immune to this attack.

Marko Bencun of Shift Cryptosecurity discovered this vulnerability and reported it to SatoshiLabs in early October of this year.

There is no evidence that any malicious actors ever exploited this vulnerability.

The latest firmware version 2.1.8, now available for Trezor Model T, mitigates the issue.

Details of the attack

Marko found that when he injected a particular multisig input and a corresponding multisig change address into a regular (non-multisig) transaction, the multisig change address was not shown on the device. This was possible because the code was missing a check to make sure that all inputs of the transaction are of the same type. If they are not of the same type (i.e. the transaction is mixing multisig and non-multisig inputs), the multisig change address should not be treated as the change and should be shown on the display.

Impact

An attacker with the ability to modify the user’s computer could trick a user into confirming a transaction that transfers their coins to a hidden multisig address controlled by an attacker (e.g. 1-of-2 multisig).

How we mitigated the issue

Fortunately, the fix was quite trivial. The solution was to mark the transaction as non-multisig when there is at least one non-multisig input involved. The malicious multisig change address then shows on the user’s device display.

Recommended security measures

We advise users of Trezor Model T to update to firmware version 2.1.8 before they make any other transactions on the device.

Users of Trezor One are not affected by this vulnerability in any way.

As always, we strongly recommend keeping all Trezor devices updated with the latest firmware to maintain the maximum level of security and ensure the latest functionality.

How to update the firmware?

At the time of writing this, the new firmware 2.1.8 is available from our web wallet. We encourage you to update, as this brings you the latest security fixes. The update process is straightforward.

“We want to thank Marko Bencun for his responsible disclosure of this vulnerability. It’s always a pleasure to see how the cooperation between different wallet vendors makes the Bitcoin ecosystem more secure for everyone.”

— Pavol “Stick” Rusnak, CTO at SatoshiLabs

Frequently Asked Questions

Is the Trezor One affected?

No, Trezor One is not affected.

I am about to buy a new Trezor Model T. Will it be affected?

We ship the Trezor devices without preloaded firmware. Therefore the latest available firmware with the latest patches is always installed during the device initialization.

Is this relevant if my Trezor gets stolen?

This attack does not help an attacker in any way to recover information from a stolen device.

Timeline

• 2019–10–01 — Issue discovered and disclosed to SatoshiLabs
• 2019–11–06 — Fix published and released in firmware 2.1.8

Revisions to this document

• 2019–11–15 12:00 CET: Original release.