WARNING: Double check your transactions even when you only bump the fee (RBF)

[pooya87]

This is a good habit to get into.
Every time you want to sign a transaction, double check, triple check everything before you click sign and enter your password. Your inputs, outputs, fee, ... see which coins you are spending and where are those coins going (the receiver's address and the change address). Check everything before you sign and click broadcast. Even if it was an existing tx you had already signed and sent (unconfirmed), and now you just want to bump its fee using RBF.

It is also better that you sign and broadcast separately and double check after signing and before broadcasting. For example Electrum has this option: you set the fee, preview, sign, then click broadcast.

Electrum just fixed a vulnerability: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
so upgrade to 4.8.3 already.

In this exploit a malicious Electrum server would receive the user's tx and refuse to propagate it; then while it remains unconfirmed according to that server alone, it returns a modified tx where the output is the attacker's address.
Now this modified tx shows up in the user's wallet software and shows as unconfirmed. Since it remains unconfirmed, the user may decide to bump the fee. In which case they'd sign this new transaction that is paying the attacker not the destination the user wanted to.

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

[Livingleged]

Thank you so much @pooya87, I think the double checking transaction can never be over emphasised. I’ve never thought of something like this before. The least thing I would think is that malicious sever could show a modified transaction and trick someone into signing it while trying to increase the fee through RBF this is crazy.
And true it’s only through double checking the transaction before signing it that can prevent this kind of attack. Take away from this is not to blindly trust any wallet server because you’ve been using it for years. And also keeping wallet update should not be overlooked.

[Hatchy]

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

We simply need to be extra careful these days because attackers are becoming more determined to gain access to our funds. Our wallets and even our transactions can be exposed to security risks. As long as you control your own keys, the responsibility falls on you to take extra precautions.

At least the vulnerability has been fixed, but we should still make it a habit to check every transaction before signing it. Always verify the transaction details, especially the output addresses. It doesn't take much time to check an address character by character, especially when we know that address poisoning can also be a problem. For those using hardware wallets, this is a reminder that no security solution offers complete protection. It's important to stay updated on the latest wallet security news and update your wallet software regularly to fix known vulnerabilities and keep your funds as safe as possible.

[stadus]

Electrum just fixed a vulnerability: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
so upgrade to 4.8.3 already.

Thank you for the warning, I've already updated mine.

[RGBTC]

To be honest, I’ve never tried signing and broadcasting from separate locations; I should give that a go next time.
My question is, when a user has "auto-connect" enabled, how likely is it that Electrum might route it to a malicious server? Do the network settings also play a role which server the wallet (auto)chooses?

[hosemary]

I always do that.
Sometimes, I even check my transaction one more time after signing it using other tools to make sure everything is fine.

For example, I sign the transaction using Electrum, export the raw transaction, import it into another tool, verify the outputs, and then broadcast it.
This way, I can make sure that there was no malware tampering with my transaction, and everything Electrum displayed on the screen was correct and matched the actual transaction data.

[pooya87]

My question is, when a user has "auto-connect" enabled, how likely is it that Electrum might route it to a malicious server?

According to the documentation [1] the "main" server (which is the single Electrum node you connect to, to update your wallet history) is selected arbitrarily. I haven't analyzed the code in details but from my understanding the only thing it checks under the hood is how responsive the server is. For example if it is lagging, your client would switch to another one. Everything else that is in the network layer (to select servers) involves the chain itself to inform the user of forks and be able to follow the longest chain.

The likelihood of it depends on how many malicious servers are running. If it is only a handful (which seems to be the case) then the chance of randomly connecting to one is very small (which seems to be the case since there has not been that many reports of "victims").

[1] https://github.com/spesmilo/electrum-docs/blob/master/faq.rst#does-electrum-trust-servers

Do the network settings also play a role which server the wallet (auto)chooses?

I don't think so.

[Agbe]

This can save or prevent people for sending their coins to a wrong person. If the person or "we" are not in hurry to hit the sign button and moat of us are good in hitting the sign button once we paste the address and input the coins. But as for me and frankly speaking, I use to check the fee but not rechecking the address again because I believed that I didn't just copy it from clipboard or saved it at somewhere and copied from there no. I always copy a raw address at all times when I am doing a transaction yet it is still good to crosscheck it before submitting it

[ObeyKnock]

Do the network settings also play a role which server the wallet (auto)chooses?

Old versions of Electrum didnt validate signatures for unconfirmed transactions and just trusted the server. Electrum 4.8.3 now validates signatures for transactions spending from your own inputs.

I would double-check the transaction. I wouldnt CPFP a transaction that I can not see in a block explorer. Always verify the tx in a block explorer before attempting a CPFP.

The fake tx in your history probably has an invalid signature and zero fee.

As for auto server selection, yes it matters. Electrum advisory says users connected only to their own or a trusted server are not exposed. If you turn off auto-select and use your own server (Fulcrum or Electrum Personal Server on your own node), there is no random Electrum server in the middle that can withhold your transaction.

[Findingnemo]

It's been a while since I bumped the fee because the fees are pretty much lower all the time so we can just make the tx to be included in the next block with 1sat/vb on most cases. And regarding the reverify, I have to because I never did that while using bump fee because the default mindset will be we are not making any changes to the sender so why bother checking again and I guess from now on I should.

[Lida93]

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

We appreciate this reminder as it was very important to bring forth over and over again since some persons that may have being doing this habit of rechecking and checking their transactions before spending may grow weary over it and just want to go over it by assuming that they're just being over-cautious and not could really go wrong just like that.

I would look into this and do the upgrade for my electrum wallet.

[tread93]

This is a good habit to get into.
Every time you want to sign a transaction, double check, triple check everything before you click sign and enter your password. Your inputs, outputs, fee, ... see which coins you are spending and where are those coins going (the receiver's address and the change address). Check everything before you sign and click broadcast. Even if it was an existing tx you had already signed and sent (unconfirmed), and now you just want to bump its fee using RBF.

It is also better that you sign and broadcast separately and double check after signing and before broadcasting. For example Electrum has this option: you set the fee, preview, sign, then click broadcast.

Electrum just fixed a vulnerability: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
so upgrade to 4.8.3 already.

In this exploit a malicious Electrum server would receive the user's tx and refuse to propagate it; then while it remains unconfirmed according to that server alone, it returns a modified tx where the output is the attacker's address.
Now this modified tx shows up in the user's wallet software and shows as unconfirmed. Since it remains unconfirmed, the user may decide to bump the fee. In which case they'd sign this new transaction that is paying the attacker not the destination the user wanted to.

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

Thank you OP its always nice to see somebody looking out for people and I do know you to always be a stand up guy or girl lol sorry cant tell but this is always a good reminder to see and I would have to ahree that you should quadruple check this!!!

[Alvin_talk]

Kudos OP!

Mmm... I don't really know for others but these recent discoveries of vulnerabilities in wallets really scares me alot. Do I think users are completely safe even after following all these precautionary procedures? Definitely NO, because even the updated version might contain another vulnerability that is yet to be discovered. Well, it is what it is.

But to protect yourself from this kind of issue, wouldn't it be better to just connect your electrum to your own node instead of relying on these third party server?

[hosemary]

But to protect yourself from this kind of issue, wouldn't it be better to just connect your electrum to your own node instead of relying on these third party server?

It's good to run your own node, but many people use SPV wallets like Electrum, because they don't want to run a node.

The best thing you can do to protect yourself is to double-check (or even triple-check) your transactions before broadcasting them. The vulnerability pooy87 mentioned was just an example. There may be other things that could tamper with your transactions.
 

[BitMaxz]

Luckily I have a good habit of double-checking any transaction I made from Electrum, and I don't know if the attacker could also send a fake transaction to a watch-only wallet since my real wallets are disconnected from the internet. I maintain the habit of checking the transaction output addresses before confirming the transaction.

I wonder if the newer version of Electrum as a watch-only wallet can generate unsigned transactions that support the older version of Electrum once I upgrade to the latest version?
I don't usually move files or installers to my cold storage; I just want to avoid any possible attacks. I only sign transactions via QR code scanning. Since I don't have a budget yet to own a node to run a 24/7 Electrum server, I'll stay using 3rd parties but only the selected one that most people trust. There are many untrusted Electrum servers nowadays; the most suspicious ones are newer nodes and IPs only.

[nullius]

Wow, that’s a nasty bug!

I don’t understand, why does Electrum need to verify the signatures?  I think it should suffice to verify that the tx matches the txid (and the signatures themselves can be verified by the known wtxid).  The TxOut fields cannot be changed without changing the txid.  Hash is cheaper than signature verification, and it should have been done all along.

Does Electrum not calculate the txid before sending the tx to the server?  (Does it not identify tx by txid, as much other software does?)

References:

[...] The client now verifies the signatures of wallet.is_mine inputs for mempool txs (before adding them to its local history). [...]

Severity: High

Merge "verify_sigs": adb: check sigs of is_mine txins of unconf txs

verify signatures of wallet.is_mine inputs for mempool txs only

PR: SE#1 (first 3 commits)

[...diff...]

I glanced at the diff, but I lack context of what Electrum’s code does elsewhere.

This is a good habit to get into.
Every time you want to sign a transaction, double check, triple check everything before you click sign and enter your password. Your inputs, outputs, fee, ... see which coins you are spending and where are those coins going (the receiver's address and the change address). Check everything before you sign and click broadcast. Even if it was an existing tx you had already signed and sent (unconfirmed), and now you just want to bump its fee using RBF.

I know you’re helping to protect user security, but this makes cryptographic money unusable.  The human user already has a high cognitive burden to handle inscrutable addresses in the first place.  What’s next?  Examine a hexdump of the transaction, byte by byte?  Verify the txid by doing SHA2-256 with pencil and paper?

It’s the wallet’s responsibility not to let an untrusted remote server replace your transaction in the wallet’s own database.  Thus, the security advisory marked “Severity: High”.

[Hazink]

We appreciate this reminder as it was very important to bring forth over and over again since some persons that may have being doing this habit of rechecking and checking their transactions before spending may grow weary over it and just want to go over it by assuming that they're just being over-cautious and not could really go wrong just like that.

Since the clipboard virus became popular and the number of victims increased, I have made it a habit to always cross-check my transaction details from starting to finish every time to make sure everything is as expected and not to make mistakes that I will leave to regret, and I expect many to be doing that because it's just extra time and cost nothing for such cross-checking.

[EluguHcman]

This is a good habit to get into.
Every time you want to sign a transaction, double check, triple check everything before you click sign and enter your password. Your inputs, outputs, fee, ... see which coins you are spending and where are those coins going (the receiver's address and the change address). Check everything before you sign and click broadcast. Even if it was an existing tx you had already signed and sent (unconfirmed), and now you just want to bump its fee using RBF.

That is a very important reminder which i find to be very much relevant for beginners.
The Bitcoin industry is Decentralised and if my means you out if mistake sends funds to the wrong wallet address, you will have very less chances to retrieve it.
Following this risk is ideally why the exchange will eveb ask users to confirm wallet address and the network type so that you don't face the risk of sending to the address while it is unrecoverable except for chances of going through third parties and security agencies.

It is also important to be aware of the keypad phishing mode which scammers also uses as a strategy to steal from their targets.
In essence, as we are getting careful so that we don't loose our funds out of our own mistakes, let us also consider scamming phishing strategies too.

A fund lost out of scam and one lost out of mistake to the wrong address is as well the same lost. We should really be careful to crosscheck at all cost to avoid regrets.

[Alvin_talk]

I know you’re helping to protect user security, but this makes cryptographic money unusable.  The human user already has a high cognitive burden to handle inscrutable addresses in the first place.  What’s next?  Examine a hexdump of the transaction, byte by byte?  Verify the txid by doing SHA2-256 with pencil and paper?[/anchor]

It’s the wallet’s responsibility not to let an untrusted remote server replace your transaction in the wallet’s own database.  Thus, the security advisory marked “Severity: High”.

Sure, it is the wallet providers responsibility not to let things go wrong. But I'll rather verify things myself than hope my wallet providers will do it for me simply because it is supposed to be their responsibility. For context, it was the responsibility of coldcard wallet to protect the coins of their users but they failed their users. At the end of the day the coins belongs to you and not the wallet providers and if something goes wrong your wallet providers won't compensate you for your loss.

Yeah, the process looks a bit cumbersome but I'll rather put those in practice instead of depending on my imperfect wallet providers alone.

[slaman29]

Thank you for the update, just updated my Electrum now.

Actually with more than 1 to 1 input output, I always use the sign and broadcast, because I want to see everything in the Electrum window first (the inputs and outputs) but I should make it a habit as you say to do it for every transaction anyway.