Inputs from a HW Wallet extended-address are not recognized as such during 'tx sign-inputs'

[mikereinhart]

CKB-CLI recognizes the lock-arg of the root Ledger account m/44'/309'/0' is from the Ledger device, but it does not recognize that extended-addresses, such as m/44'/309'/0'/0/0 are associated with the hardware wallet. As a result, they cannot be signed with during tx sign-inputs.

Here are both the root and an extended-address:

CKB> account extended-address --lock-arg 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --path "m/44'/309'/0'"
address:
  mainnet: ckb1qyqg64fqws0sdgrz2s7da2dzrlpq6plw9xcqhuexcr
  testnet: ckt1qyqg64fqws0sdgrz2s7da2dzrlpq6plw9xcq2e8e5l
lock_arg: 0x8d5520741f06a062543cdea9a21fc20d07ee29b0

CKB> account extended-address --lock-arg 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --path "m/44'/309'/0'/0/0"
address:
  mainnet: ckb1qyqw2fsdswd8s6kz4yy3s80e5s3lrma7sc7sugcvv9
  testnet: ckt1qyqw2fsdswd8s6kz4yy3s80e5s3lrma7sc7spdxnqe
lock_arg: 0xe5260d839a786ac2a909181df9a423f1efbe863

I've used them each as inputs in a transaction:

CKB> tx info --tx-file multi-input.json
[input] ckt1qyqg64fqws0sdgrz2s7da2dzrlpq6plw9xcq2e8e5l => 1000.0, (data-length: 0, type-script: none, lock-kind: sighash(secp))
[input] ckt1qyqw2fsdswd8s6kz4yy3s80e5s3lrma7sc7spdxnqe => 1000.0, (data-length: 0, type-script: none, lock-kind: sighash(secp))
[output] ckt1qyqru2kkvk3vk35k607y5gtsglwjtccdw0xssjfass => 1999.99, (data-length: 0, type-script: none, lock-kind: sighash(secp))
input_total: 2000.0 (CKB)
output_total: 1999.99 (CKB)
tx_fee: 0.01 (CKB)

I can sign with the root path:

CKB> tx sign-inputs --from-account 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --tx-file multi-input.json
- lock-arg: 0x8d5520741f06a062543cdea9a21fc20d07ee29b0
  signature: 0x22a9b459e114b712f97a491739e0fe5c682dbe73cecd246fc3e6184c81701de70e2626bc022558900aadf1cabd618e6b06986fd3f24284da8c1dbe45ffea47f601

But signing fails with the extended-address, as CKB-CLI does not know it is from the hardware wallet:

CKB> tx sign-inputs --from-account 0xe5260d839a786ac2a909181df9a423f1efbe863d --tx-file multi-input.json
Ledger account for lock_arg: H160 ( [ 0xe5, 0x26, 0x0d, 0x83, 0x9a, 0x78, 0x6a, 0xc2, 0xa9, 0x09, 0x18, 0x1d, 0xf9, 0xa4, 0x23, 0xf1, 0xef, 0xbe, 0x86, 0x3d ] ) not found

Note: The error message above is incorrect as reported here - https://github.com/nervosnetwork/ckb-cli/issues/343. I'll update this issue after testing this again on https://github.com/nervosnetwork/ckb-cli/tree/ledger-support

Suggested Solution

Since CKB-CLI has the ability to search derived (extended) addresses, perhaps the user can have the option of supplying information about the root Ledger address during tx sign-inputs.

For instance:

CKB> tx sign-inputs --from-account 0xe5260d839a786ac2a909181df9a423f1efbe863d --root-address ckt1qyqg64fqws0sdgrz2s7da2dzrlpq6plw9xcq2e8e5l --tx-file multi-input.json

A simpler flag such as --ledger wouldn't work here as the user can have multiple accounts in the same client tied to different Ledger devices. Any suitable solution should reference a specific account for CKB-CLI to search.

[TheWaWaR]

I think use a sub key as account argument is not a good idea, since account serve as the identify of the wallet.

How about use:

CKB> tx sign-inputs --from-account 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --path "m/44'/309'/0'/0/0"

For signing inputs from a particular sub key of 0x8d5520741f06a062543cdea9a21fc20d07ee29b0

And use:

CKB> tx sign-inputs --from-account 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --derived

For signing inputs from root and all sub keys of 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 (auto search the sub key space)?

[mikereinhart]

Great point about identifying the wallet. So to confirm, instead of

CKB> tx sign-inputs --from-account 0xe5260d839a786ac2a909181df9a423f1efbe863d --tx-file multi-input.json

the user would do:

CKB> tx sign-inputs --from-account 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --path "m/44'/309'/0'/0/0" --tx-file multi-input.json

Or, if there are inputs from different addresses which are all associated with the same account, they could do

CKB> tx sign-inputs --from-account 0x8d5520741f06a062543cdea9a21fc20d07ee29b0 --derived

and sign for all inputs at once.

That sounds very good!

[TheWaWaR]

Yes.

[github-actions[bot]]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.

[github-actions[bot]]

This issue was closed because it has been stalled for 5 days with no activity.