vacuumlabs/trezor-firmware

trezor incorrectly warns about wrong staking data for paths with hardened index

Closed this issue · 1 comments

the function that checks for staking compatibility will return a MISMATCH even in cases where the address doesn't pass generic validation, even after the user already consented to derivation of said non-valid path.

the call to get_address() first checks for path validity, and displays proper warnings, then the address is derived, then if the user selected to display the address it goes to _display_address() and that into _show_staking_warnings().
this is where the program check for matching staking info with the address using staking_use_cases.get() (this should probably be renamed as this function doesn't get anything, it checks/validates).

however the check function doesn't have a fail state, and will return MISMATCH even when its generic validations fail, which in this case should be ignored, as to even get to this point user must have consented to derivation of invalid path.

the check function needs to be refactored to a) have its name reflect its actual use b) have a fail state and c) have the option to ignore the fail state in cases where it makes sense (e.g. in get_address())

fixed in trezor#1423