SegWit double-signing flaw could make Trezor users pay a huge fee

On 3 June 2020 Trezor released Trezor One firmware 1.9.1 and Model T firmware 2.3.1 to fix a flaw in how SegWit transactions are signed. The CVE record (CVE-2020-14199) states that BIP-143 mishandles the signing of a SegWit transaction, allowing attackers to trick a user into making two signatures in certain cases, potentially leading to a huge transaction fee, and notes that the issue affects all hardware wallets.

Trezor’s post describes the scenario: malware on the computer shows the user a transaction, reports an error after it is signed and asks for a second, apparently identical confirmation with the input amounts misstated; it then combines one signature from each attempt into a transaction that spends both inputs in full, so the difference goes to the fee (just over 15 BTC in Trezor’s example). The fix treats SegWit inputs like non-SegWit ones and requires the previous transactions to verify the real input amounts. Trezor notes that this broke signing in some third-party tools, including Electrum and PSBT-based software such as HWI, BTCPay Server and Wasabi, until they were updated.

Trezor’s list of past security issues credits Saleem Rashid with the report, dated 3 March 2020, and rates it high with destruction of funds as the impact. Trezor states that the flaw is inherent in the design of BIP-143, affects all hardware wallet vendors, and that the fix took longer than usual because it followed coordinated disclosure and some vendors asked for 90 days.