Skip to content

Keep emergency payout keys local - #97

Open
hiciefte wants to merge 6 commits into
bisq-network:mainfrom
hiciefte:content/emergency-multisig-local-signing
Open

hiciefte wants to merge 6 commits into
bisq-network:mainfrom
hiciefte:content/emergency-multisig-local-signing

Conversation

@hiciefte

@hiciefte hiciefte commented Nov 10, 2026 •

Copy link
Copy Markdown
Collaborator

Replaces #85, which was opened from a branch in this repository. The changes are the same; the commits were re-signed with corrected authorship.

Addresses migration note local-signing-not-private-key-collection ("Manual payout: local signing") for the restored 2021 article Emergency Multisig payout tool (src/content/docs/wiki/emergency-multisig-payout-tool.md, wiki revision 2011, 20 January 2021).

The restored guide tells traders to copy their wallet's private keys into a text editor, save the key in a bisqWallet.txt file and remove the wallet password. This PR replaces that part with the local key lookup and signing that Bisq 1 v1.10.11 provides, consistent with #105 (Manual payout). Title, headings, step order, tables, the Precautions section and the Warning's advice are unchanged.

Commits

  1. Format the emergency payout source for review (formatting only). The article was imported as one 6.7 KB source line. This decodes its 135 
 entities into line breaks, using the same rule as the formatting baseline. The rendered page differs from main only in writing a newline as \n instead of 
.
    This is one of the three additional historical articles, whose receipt is output_sha256 in migration/additional-articles.json, not the 209-article fidelity manifest. So the commit also lets a migration/source-formatting.json record belong to an additional article (scripts/check-source-fidelity.mjs, scripts/lib/additional-articles.mjs), adds a test and one sentence to CONTRIBUTING.md. The receipt hash itself is not changed.
  2. Keep emergency payout keys local (wording).
  3. Reject non-integer formatting offsets for additional articles. Review found that commit 1's check undid the recorded line breaks without validating the offsets: a string offset made slice() drop text, so inserted content could vanish before the receipt hash was taken and an edited article passed the gate. It now applies the same checks as for the 209 originals (an array of safe integers inside the file, and the undone text must hash to the recorded imported file), with a test using a synthetic record.
  4. Say what to do when the key is not found, and never to send a screenshot (wording, from review).

Wording changes

Section Before After
Warning In this process traders copy and paste their private keys from the Bisq software into a notepad. In the original 2021 process, traders copied and pasted their private keys from the Bisq software into a notepad. (The precaution that follows is unchanged.) Added at the end: If you use LOCATE KEY IN WALLET (see Get private keys), switch only after the payout is confirmed: it finds keys only in the wallet that made the trade.
What you need Open a text editor where you can gather all this information. ... all this information, except private keys.
Get private keys "To access your Bisq wallet private key", five steps (Ctrl+J, Include private keys, COPY TO CLIPBOARD into a text editor, find priv HEX=, save in bisqWallet.txt), and the note that a password-protected wallet must have its password removed. In Bisq 1 v1.10.11, keep private keys inside Bisq. After you import the unsigned transaction (see Sign Transaction), LOCATE KEY IN WALLET on the SIGN screen finds your key for this trade in the wallet and fills the privateKeyHex field; GENERATE SIGNATURE then signs on your computer. Share only the resulting signature: never send a private key or seed words to the mediator or anyone else. / If the field shows Not found in wallet, check that Bisq is running with the data directory you used for this trade; do not paste a key from anywhere else, and ask the mediator for help. You do not need to remove your wallet password: Bisq uses the password you entered at startup. / This replaces the original 2021 steps, which copied wallet data including private keys into a text editor and saved the key in a bisqWallet.txt file.
Sign Transaction, step 2 Go to SIGN and paste your private key for this trade (priv HEX=) and click GENERATE SIGNATURE. Go to SIGN, click LOCATE KEY IN WALLET to fill in your private key for this trade, and click GENERATE SIGNATURE.
Sign Transaction, step 3 Copy the signature hex that you get and share it with the mediator ... share it with the mediator. Use the copy icon next to it; do not send a screenshot of the SIGN screen, because it shows your private key.

The removed steps remain in the preserved original wikitext (public/wiki-source/emergency-multisig-payout-tool.wiki.txt), linked from the page's "Source and history" section.

Sources

All at Bisq commit ea9d5dff90c99ac462f2b0a7bf9ef92683956619, the target of tag v1.10.11.

  • SignPane.java L55-L98: "Locate key in wallet" needs the inputs first, searches the running wallet's listing for the buyer's or seller's public key and fills privateKeyHex, or writes "Not found in wallet". privateKeyHex is a plain text field on the same screen as the signature, which has a copy icon. "Generate Signature" computes the signature locally.
  • CommonPane.java L36-L60: the key search on the wallet listing.
  • ImportPane.java L70-L80: IMPORT FROM STRING fills the inputs, including both public keys, so step 1 of Sign Transaction prepares what Locate needs.
  • BuildPane.java L106-L135: the build step combines the buyer and seller signatures; it takes no private key.
  • AutoTooltipButton.java L35-L46: button labels are shown in upper case.
  • Password: BisqSetup.java L458-L477 sets the wallet key after the startup password prompt, and BtcWalletService.java L144-L154 passes that key into the wallet listing (the old "only if not encrypted" line is commented out). The bitcoinj fork pinned by Bisq is not in the Bisq repository; its compiled jar (commit 6c32c062, hash matching gradle/verification-metadata.xml) decrypts a key with the given AES key when it formats the listing.

What was checked and what was not

  • Checked: the source files above, read at the pinned commit; the bitcoinj fork from its compiled jar. The edited page was built and viewed in the local build. Ctrl+G still opens the support tool in v1.10.11, so the article's shortcut is unchanged.
  • Not done: nothing was run in the Bisq application. No signature was generated, no payout was built or broadcast, no wallet was used, and LOCATE KEY IN WALLET was not tried on a password-protected wallet. The password sentence rests on the code reading above.
  • Not changed (out of scope, for reviewers): the "What you need" table. At the pinned commit the Inputs pane also has a depositTxLegacy checkbox and computed fee fields, which the 2021 table does not list; depositTxId is listed.

Expected check results

check fails, and will keep failing until maintainers decide how edits to the additional historical articles are accepted. Accepted-edit receipts (#96, #183) cover only the 209 restored articles. This article is one of the three additional historical articles (migration/additional-articles.json, marked historical_only), so no receipt can accept its wording yet. On this branch, node scripts/check-source-fidelity.mjs stops with additional rendered article drift: emergency-multisig-payout-tool (formatted source), and the npm test cases that run the gate on the committed files fail for the same reason. The receipt was not refreshed to hide the difference.

Two ways forward:

  • Extend accepted-edit receipts to the additional articles in a separate technical PR (same rules and approvals as for the restored articles), then add a receipt here after review.
  • Keep the additional articles historical-only and close this PR.

Decode the 135 newline entities in the one-line Emergency Multisig
payout tool source so each element can be reviewed separately. The
rendered page is unchanged apart from entity spelling.

This article is an additional historical source, so its receipt lives
in additional-articles.json. Let a source-formatting record apply to
additions and rebuild the exact imported bytes before checking that
receipt. The receipt hash itself is not changed.
Stop the restored 2021 guide from telling traders to copy wallet private
keys into a text editor and a bisqWallet.txt file. Point the Get private
keys section and the signing step to the local Locate key in wallet and
Generate Signature actions, and keep the warning, scoped to the original
2021 process.

Sources: Bisq 1 v1.10.11 SignPane.java L76-L138 (local key lookup and
signing), BuildPane.java L106-L135 (signature assembly) and
ImportPane.java L70-L80 (import fills the inputs), commit ea9d5dff.

Keep original source and review snapshots unchanged. Leave publication
blocked pending support review and explicit acceptance of these edits.
The receipt check for the three additional articles undid recorded line
breaks without checking the offsets. A string offset made slice() drop
text, so inserted content could vanish before the receipt hash was taken
and an edited article passed the gate. Apply the same checks as for the
209 originals: an array of safe integers inside the file, and the undone
text must hash to the recorded imported file. A test covers string,
fractional and missing offsets with a synthetic record.
LOCATE KEY IN WALLET searches only the running wallet, so switching
data directories before the payout breaks it; say so next to the
Warning's advice to switch. If the field shows Not found in wallet,
point to the data directory and the mediator instead of any other key
source. The SIGN screen shows the private key in a plain text field, so
copy the signature with its icon instead of sending a screenshot. In the
v1.10.11 source, the wallet listing uses the password entered at
startup, so the password does not have to be removed.
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

Commits

Reviewing files that changed from the base of the PR and between 4b84f47 and 5a3915a.

Files selected for processing: 6

  • CONTRIBUTING.md
  • migration/source-formatting.json
  • scripts/additional-articles.test.mjs
  • scripts/check-source-fidelity.mjs
  • scripts/lib/additional-articles.mjs
  • src/content/docs/wiki/emergency-multisig-payout-tool.md

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Resolves two conflicts with the accepted-edit receipts (bisq-network#96):
- CONTRIBUTING.md: keeps this branch's sentence about additional articles
  and the new Accepted editorial changes section from main.
- scripts/check-source-fidelity.mjs: imports both additionalArticles and
  the accepted-edits helpers.

With the article at its formatting-only commit (745df9b), npm test (68)
and npm run build pass, so the remaining check failure is only the
unreceipted wording change this PR proposes.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant