[Desktop] wallet not using latest version of Trezor Connect

[SCBuergel]

Description

brave://wallet still uses v7 of Trezor Connect and not the suggested and more secure v8.

Steps to Reproduce

1. Setup a Trezor hardware wallet with latest firmware and connect it to your computer
2. Open brave://wallet
3. In your accounts list, click Connect Hardware Wallet
4. Select Trezor in and click Connect

Actual result:

This opens https://connect.trezor.io/7/popup.html which is not the latest version

Expected result:

I expect to be redirected to https://connect.trezor.io/8/popup.html which is the latest version

Reproduces how often:

Every single time

Brave version (brave://version info)

Brave | 1.10.97 Chromium: 83.0.4103.116 (Official Build) (64-bit)
-- | --
Revision | 8f0c18b4dca9b6699eb629be0f51810c24fb6428-refs/branch-heads/4103@{#716}
OS | Linux

Other Additional Information:

• Does the issue resolve itself when disabling Brave Shields?
  No

• Does the issue resolve itself when disabling Brave Rewards?
  No

• Is the issue reproducible on the latest version of Chrome?
  Not applicable as Chrome does not ship with an integrated wallet but this is already resolved in the latest version of MyEtherWallet and MyCrypto which both redirect to v8.

[ryanml]

Related upstream issue: MetaMask/metamask-extension#8349

[snodnipper]

I tried using it just this morning. Attempting to select an address to enable the Unlock button is not possible at the moment 😞

[ryanml]

@snodnipper - looks to be an issue with our dark theme. Can you try to change to the light theme via brave://settings and see if you can get through that screen?

[snodnipper]

Well I did change it to light but I have more fundamental issues now. The https://connect.trezor.io/7/popup.html is just endlessly looping. I have closed other browsers / tabs and https://wallet.trezor.io/ seems to work as expected.

I see others have had this issue too with older versions of metamask https://community.brave.com/t/both-brave-wallet-and-trezor-connect-pages-hang-indefinitely-when-trying-to-connect-a-trezor-for-the-first-time/132401/4

I am using Metamask 8.0.6, which is working fine when accessing web3 sites.

@ryanml I am guessing that you do not have a Trezor to test out yourself?

[HeroHann]

Might be related to this: MetaMask/metamask-extension#8349

Please have a look. With Brave Wallet I get the same problem as with MetaMask.

Main problem: There is no option to input the passphrase directly on the Trezor instead we are forced to input it into the browser, which is a security risk.

[srirambv]

+1 from https://community.brave.com/t/issue-loading-crypto-wallets/164325

[yumyumfarted]

@srirambv Thanks, I'll continue here. I'll also paste the error code to make it easier for people to reference.

I'm having a different issue entirely. I am not able to get to that screen at all. I will put the error message below. One issue that it might have been was that my Trezor wasn't connected during the process of me clicking connect. Also, I'm not sure how to reset it, as I don't have any assets in that account anyway. I wouldn't mind making a new one.

TypeError: Cannot read property ‘balance’ of undefined
at chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui.js:1:2576729
at chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1186943
at chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1187437
at y (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui.js:1:2576682)
at ha (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1059446)
at ju (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1104711)
at kl (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1090256)
at Rl (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1090181)
at xl (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1087521)
at ml (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1084265)
at is (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1112272)
at chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1113505
at Sl (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1087872)
at cs (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1113490)
at render (chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui-libs.js:1:1115419)
at chrome-extension://odbfpeeihdkbihmopkbjmoonfanlbfcl/ui.js:1:3584895

note: I tried uninstalling all of my extensions, making sure trezor bridge was installed and running, and that my trezor was connected.

[yumyumfarted]

Updating Brave to the latest version and making sure the Trezor seemed to fix the issue.

[bitofit]

This thread was hijacked by an unrelated issue. Brave still needs to update to Trezor Connect V8. Version 7 requires users to type their passphrase into the browser instead of on device which is a security concern.

[bitofit]

Related upstream issue: MetaMask/metamask-extension#8349

This issue was resolved by Metamask back in January. Brave Wallet still needs to upgrade from Trezor popup V7 to V8.

[bitofit]

@srirambv @ryanml can this be re-visited? Requiring passphrases to be typed into the computer vs on hardware device is a serious security concern that should be addressed ASAP.

[Fluxty]

@srirambv @ryanml can this be re-visited? Requiring passphrases to be typed into the computer vs on hardware device is a serious security concern that should be addressed ASAP.

Agreed. Need to update Trezor connect for Brave wallet.

[srirambv]

This will probably be addressed in the native wallet integration

cc: @bbondy @onyb @Douglashdaniel

[onyb]

It'll be a while for the native wallet to be ready. If this is a low-effort task, I think we should add support for Trezor Connect V8 in ethereum-remote-client, since this has security implications.

@srirambv Any chance you got a Trezor Model T to help with the tests?

[srirambv]

@onyb Nope only Tezor One. Doesn't work wit Brave as we still don't support V8

[onyb]

Just added support for Trezor Connect v8 with brave/ethereum-remote-client@6bd81fa. I was able to do a successful transaction with a Trezor Model T + on-device passphrase, using brave/ethereum-remote-client#268.

@srirambv I updated the QA plan for EIP-1559 to include tests for Trezor integration (see #17160).

Additionally, we're ready with support for Type-2 transactions (EIP-1559) on Trezor, and will enable it as soon as the new firmware is available (ETA September 8, 2021).

[srirambv]

Moved it into release milestone based on previous comment. Will be testing the Trezor connect using Trezor one for now

[srirambv]

Verification passed on

Brave	1.29.75 Chromium: 93.0.4577.58 (Official Build) (x86_64)
Revision	c4410ece044414ea42fa4ba328d08195e818a99c-refs/branch-heads/4577@{#1076}
OS	macOS Version 11.5.2 (Build 20G95)
Component	1.0.38 dev

• Verified able to connect Trezor and unlock the account

---

Verification passed on

Brave	1.30.65 Chromium: 93.0.4577.63 (Official Build) beta (64-bit)
Revision	ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@{#1135}
OS	Linux
Component	1.0.38 dev

• Verified able to connect Trezor and unlock the account

---

Verification passed on

Brave	1.31.27 Chromium: 93.0.4577.63 (Official Build) nightly (64-bit)
Revision	ff5c0da2ec0adeaed5550e6c7e98417dac77d98a-refs/branch-heads/4577@{#1135}
OS	Windows 10 OS Version 2009 (Build 19043.1165)
Component	1.0.38. dev

• Verified able to connect Trezor and unlock the account