<p>It will always be the case that the more parties that are involved in a transaction, the greater the attack surface.</p>
<p>This is true of the universe generally and is not Bitcoin specific.</p>
<p>You cannot conclude that multisig is less secure than single-signature unless you know that all other factors in the specific scenario are not favourable to multisig.</p>
<p>You have to take into account whatever factors cause participants to need a multisignature transaction and how that compares with the security of any alternative process - perhaps an unsecured compound process involving several single-signature transactions.</p>

CC BY-SA 4.0
2023-04-19T11:36:56.290Z
2023-04-19T11:42:16.137Z
2023-04-19T11:42:16.137Z
RedGrittyBrick
<blockquote>
<p>since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?</p>
</blockquote>
<p>This is not correct.</p>
<p>Yes, all the xpubs need to be known at signing time to (re)construct the full redeemscript. But the xpubs are not secret, so they can be backed up in several places without increasing security risk. It suffices if just one of the signers has access to the correct xpubs, since that one signer can inform the others. In fact, these xpubs don't even need to be (just) stored on the hardware devices, they can be backed up independently, and typically are.</p>

CC BY-SA 4.0
2023-04-20T04:10:48.923Z
My concern is not with losing xpub backups, but with obtaining a valid xpub in the first place. As far as I can tell, there is nothing inherent to multisig setups that guarantee the displayed xpubs were derived from your seed phrase. The only way to gain confidence is to reproduce them on separate device, or with a mnemonic converter. In a single sig setup this is also true, but since with multisig there can be three devices with this issue instead of one, in this respect multisig is more vulnerable. But maybe malware on a hardware wallet swapping its xpub doesn't make sense in practice?
chaulmianmints
CC BY-SA 4.0
2023-04-20T11:37:48.097Z
@chaulmianmints You only need your treshold to be honest in this regard. E.g. in a 2-of-3 setup, it's fine if one device gives an incorrect xpub, as you'll never need a signature with it. It's true that *changing* the xpub after setup will make funds unspendable, but that just means you need to use the same xpub at address generation time and at spending time; it doesn't matter whether that xpub can actually be signed for.
Pieter Wuille
CC BY-SA 4.0
2023-04-21T02:58:17.233Z
Oh duh! It doesn't matter that one of the xpubs was created using an attacker controlled recovery seed, so long as I have all of the xpubs backed up. I can still reproduce the addresses, because I know all the xpubs that were used to created them. And it doesn't matter that I don't have the xpriv from the attacker's recovery phrase, because I still have control of 2 of 3 xprivs.
chaulmianmints
CC BY-SA 4.0
2023-04-19T14:30:42.663Z
2023-04-19T14:30:42.663Z
Pieter Wuille
<p><strong>Scenario</strong>: (2 of 3 multisig) one of the hardware wallets is running malware and uses an attackers xpub instead of the one derived from the recovery phrase. This swapped xpub is reported to all the other cosigners and the software wallet. All signing devices corroborate that they are all using the same set of xpubs, and that their respective sets of receive addresses match those displayed on the software wallet. But the funds sent to these addresses do not belong to the owner, as their redeem scripts were created using an xpub the owner does not have knowledge of.</p>
<p>If the owner were to wipe the devices and recover their multisig setup on a new set of devices free of malware, they would be shown a completely different wallet with empty addresses. In order to recover their funds they would need the missing xpub from the previously malware infected hardware wallet.</p>
<p><strong>Question</strong>: If this scenario is possible, isn't multisig actually less secure than single sig, since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?</p>

CC BY-SA 4.0
2023-04-19T10:46:31.833Z
How does "all signing devices corroborate that they are all using the same set of xpubs" ?
Saxtheowl
CC BY-SA 4.0
2023-04-21T03:26:07.130Z
What I meant by that was all devices (assuming they have the feature) display their own xpub as well as the cosigners xpubs. After checking all three devices you see that the same three xpubs have been displayed on each device.
chaulmianmints
<multi-signature><wallet-security><xpub><malware>
Is multisig less secure than single sig, since only one xpub needs to be swapped by an attacker to lose funds?
chaulmianmints
# Is multisig less secure than single sig, since only one xpub needs to be swapped by an attacker to lose funds?

(Asked by: username_0 on 2023-04-19)

**Scenario**: (2 of 3 multisig) one of the hardware wallets is running malware and uses an attackers xpub instead of the one derived from the recovery phrase. This swapped xpub is reported to all the other cosigners and the software wallet. All signing devices corroborate that they are all using the same set of xpubs, and that their respective sets of receive addresses match those displayed on the software wallet. But the funds sent to these addresses do not belong to the owner, as their redeem scripts were created using an xpub the owner does not have knowledge of.

If the owner were to wipe the devices and recover their multisig setup on a new set of devices free of malware, they would be shown a completely different wallet with empty addresses. In order to recover their funds they would need the missing xpub from the previously malware infected hardware wallet.

**Question**: If this scenario is possible, isn't multisig actually less secure than single sig, since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?

**Tags:** multi-signature, wallet-security, xpub, malware

> **Comments:**
> **username_1**: How does "all signing devices corroborate that they are all using the same set of xpubs" ?  
> **username_0**: What I meant by that was all devices (assuming they have the feature) display their own xpub as well as the cosigners xpubs. After checking all three devices you see that the same three xpubs have been displayed on each device.  

---

## 2 answers

### Answer by username_3 on 2023-04-19. Score: 3 | Accepted answer

> since a single malware infected hardware wallet still compromises the entire setup, but now instead of an attack surface of 1 hardware wallet, you now have 3 (from different brands with different vulnerabilities) that can be compromised?

This is not correct.

Yes, all the xpubs need to be known at signing time to (re)construct the full redeemscript. But the xpubs are not secret, so they can be backed up in several places without increasing security risk. It suffices if just one of the signers has access to the correct xpubs, since that one signer can inform the others. In fact, these xpubs don't even need to be (just) stored on the hardware devices, they can be backed up independently, and typically are.

> **Comments:**
> **username_0**: My concern is not with losing xpub backups, but with obtaining a valid xpub in the first place. As far as I can tell, there is nothing inherent to multisig setups that guarantee the displayed xpubs were derived from your seed phrase. The only way to gain confidence is to reproduce them on separate device, or with a mnemonic converter. In a single sig setup this is also true, but since with multisig there can be three devices with this issue instead of one, in this respect multisig is more vulnerable. But maybe malware on a hardware wallet swapping its xpub doesn't make sense in practice?  
> **username_3**: @username_0 You only need your treshold to be honest in this regard. E.g. in a 2-of-3 setup, it's fine if one device gives an incorrect xpub, as you'll never need a signature with it. It's true that *changing* the xpub after setup will make funds unspendable, but that just means you need to use the same xpub at address generation time and at spending time; it doesn't matter whether that xpub can actually be signed for.  
> **username_0**: Oh duh! It doesn't matter that one of the xpubs was created using an attacker controlled recovery seed, so long as I have all of the xpubs backed up. I can still reproduce the addresses, because I know all the xpubs that were used to created them. And it doesn't matter that I don't have the xpriv from the attacker's recovery phrase, because I still have control of 2 of 3 xprivs.  

---

### Answer by username_2 on 2023-04-19. Score: 2

It will always be the case that the more parties that are involved in a transaction, the greater the attack surface.

This is true of the universe generally and is not Bitcoin specific.

You cannot conclude that multisig is less secure than single-signature unless you know that all other factors in the specific scenario are not favourable to multisig.

You have to take into account whatever factors cause participants to need a multisignature transaction and how that compares with the security of any alternative process - perhaps an unsecured compound process involving several single-signature transactions.


---

