sign_psbt: add 2of3 recovery path comment for is_green_multisig_signers
What the developer wrote
Authored by Mihailo Milenkovic
sign_psbt: add 2of3 recovery path comment for is_green_multisig_signers
What changed, and why it matters
This commit only adds a code comment explaining an existing limitation in how Blockstream Jade detects Green multisignature transactions. No code behavior changes. The comment documents that for a specific 2-of-3 recovery wallet setup, the device may skip extra Green-specific validation and fall back to treating the transaction as a standard 2-of-3 multisig, but signing still works correctly.
No action required. This is a documentation-only commit. If the described limitation is considered a security concern, it should be tracked as a separate issue with a functional change, not via this commit.
Security signals we found
Comment-only change with no functional code modification
Documents a known behavior/limitation rather than fixing a vulnerability
States that signing still works correctly in the described fallback case
Evidence from the diff
The diff adds a 9-line comment block above is_green_multisig_signers() in main/process/sign_psbt.c. It clarifies that the function identifies Green multisig inputs and that downstream additional validation depends on this identification. It notes a corner case: for 2of3 recovery paths where the recovery key path starts from the recovery mnemonic’s root rather than from m/3’/subaccount’, the function cannot distinguish the user key from the recovery key and returns false. In that case signing proceeds as a non-Green standard 2of3, skipping extra validation. The implementation is unchanged.
Changed components
main/process/sign_psbt.cInspect captured patch +9 / −0
diff --git a/main/process/sign_psbt.c b/main/process/sign_psbt.c
index a1bcc99..0c0ad88 100644
--- a/main/process/sign_psbt.c
+++ b/main/process/sign_psbt.c
@@ -42,6 +42,15 @@ static const uint8_t PSET_MAGIC_PREFIX[5] = { 0x70, 0x73, 0x65, 0x74, 0xFF }; //
#define PSBT_OUT_CHUNK_SIZE (MAX_OUTPUT_MSG_SIZE - 64)
+// Check if the input corresponds to a green multisig input.
+// If identified as a Green input here, additional validation is done later.
+// NOTE: For 2of3 multisig inputs, if the users recovery path is a full path
+// (from the root of the recovery mnemonic's key) instead of the path
+// from the first parent key (m/3'/subaccount'), then this logic cannot
+// determine which key is the user key vs the recovery key and so will
+// return false. Signing still works correctly, but the additional
+// validation is skipped as the tx is treated as non-Green standard 2of3.
+// The Green wallets based on gdk provide the short path for 2of3 PSBTs.
static bool is_green_multisig_signers(const network_t network_id, const key_iter* iter, struct ext_key* recovery_hdkey)
{
JADE_ASSERT(network_id != NETWORK_NONE);
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.