bad signature on the TRON app about speculos HOT 22 CLOSED

I got the same error when sending USDT token.
How can I fix this problem?
{
error: 'SIGERROR',
message: 'Validate signature error: e13eaebfab8b0ca308fc9aaa970b3418f2d387adc44a0a46a22145a021caf5a4e1223ec0fb7895bd8f5ac8b624930e9ca52cdedafe11e0993dc15b0dc5df69a801 is signed by TGEbBaHpoVXbLzbo1heSENn2GjThAFgT2n but it is not contained of permission.'
}

from speculos.

Tron is using recoverable ECDSA signatures: https://github.com/LedgerHQ/app-tron/blob/v0.3.0/src/helpers.c#L86-L103. This kind of signatures enables recovering the public key from a transaction and its ECDSA signature, but requires information about the parity of the "y" coordinate of the signature point and another parameter more complex to explain (for each ECDSA signatures, there can be at most 4 public keys that generated it and the "recovery ID byte" is used to select one of them).

The implementation of recoverable ECDSA signatures in the Tron application relies on using info in the call of cx_ecdsa_sign:

    cx_ecdsa_sign(&privateKey, CX_RND_RFC6979 | CX_LAST, CX_SHA256,
                      transactionContext->hash, sizeof(transactionContext->hash),
                      signature, sizeof(signature), &info);
/* ... */
    transactionContext->signature[64] = 0x00;
    if (info & CX_ECCINFO_PARITY_ODD) {
        transactionContext->signature[64] |= 0x01;
    }

Currently speculos does NOT fill info, as shown by the UNUSED macro in

In the test output, the signature was 8f80e965d007c137e4559ade81dfa5d7bf9787dc5873db2efdc8ac0609c20b2d11379a0155969709120c51af4f7186abbb3385671ab6c4d37526b16e3c92b96a00. It would be nice to check whether the same transaction with 01 instead of 00 as last byte, would be fine. If yes, the issue is definitively caused by Speculos not filling info. Otherwise, it is something else.

from speculos.

We are having exactly the same issue in another app:
1- info does not contain correct data. V value is not always correct, if we patch the V (recovery value) we can get signatures to be accepted.
2- even when using RFC6979, signatures change all the time. They are all valid but not stable.

from speculos.

regarding the initial task, i think we can assume it is fixed btw. this issue can be closed, TRON is working now. Maybe worth creating another issue @jleni if latest speculos is still broken for you. thanks.

from speculos.

no, adding this PR it works well now 💯
It was the very same problem

from speculos.

glad to hear that 👍

from speculos.

@fullstackdev0410 what is up with this TGEbBaHpoVXbLzbo1heSENn2GjThAFgT2n ? Did you find its private key somewhere or something? I see many users attempting to recover USDT from this account

from speculos.

I got the same error when sending USDT token. How can I fix this problem? { error: 'SIGERROR', message: 'Validate signature error: e13eaebfab8b0ca308fc9aaa970b3418f2d387adc44a0a46a22145a021caf5a4e1223ec0fb7895bd8f5ac8b624930e9ca52cdedafe11e0993dc15b0dc5df69a801 is signed by TGEbBaHpoVXbLzbo1heSENn2GjThAFgT2n but it is not contained of permission.' }

Hello can you tell me about it my telegram id is https://t.me/njratmy0101 pls contact my Tele so i can try to help see if i can help with your problem pls contact immediately... I think i have solution for your problem if it works..

from speculos.

@fullstackdev0410 hello are u there pls reply

from speculos.

I got same problem if u can help?

from speculos.

If u can help use my tele please @mertoksuuzz

from speculos.

These are scammers @spacessx1

from speculos.

@epheph I got problem on my own trustwallet

from speculos.

Got stuck USDT?

from speculos.

Yes and the problem is almost the same dude how can i revoke the signature

from speculos.

How much USDT

from speculos.

Around 960

from speculos.

Address? Is it yours or did you find a private key somewhere?

from speculos.

They scammed my trons i got their trustwallet cant get my money back:/ can u write to my tele??

from speculos.

Hello i can help i have solution for this problem send me a pm to my tele @njratmy0101

from speculos.

You should not solicit or receive help on TG. you will be scammed again.
You can look up flashbots and find a way to request help there from a place you already trust

from speculos.

I am pretty new in github and mobile atm 👎

from speculos.