TL;DR
Register the wallet on the BitBox02 and the Ledger, then check a receive address on their screens. From now on you trust a registered device’s screen, not the computer.
What you need
- The wallet from step 6, with the descriptor backed up (step 7)
- All three devices
Sparrow runs on a computer, and computers can be tampered with. A hardware wallet that has your multisig registered knows your three keys and calculates the address itself. If its screen matches Sparrow, the address really belongs to your wallet.
That’s why registration matters. The BitBox02 and the Ledger check addresses against a registration you confirm once (the BitBox02 keeps it on the device; for the Ledger, Sparrow keeps the proof in the wallet file). The Trezor doesn’t: it uses whatever setup Sparrow sends. Its address check only proves the address matches that setup, so a compromised computer could send a setup with an attacker’s key in it. Use the Trezor as an extra check, not the only one.
Steps
- Open the Receive tab in Sparrow.
- BitBox02: connect it, click Display Address and confirm on the device when it asks to register the multisig. It remembers this permanently. Compare the address with Sparrow, every character; it scrolls, so take your time.
- Ledger: Sparrow asks you to register the wallet policy the first time you use it with this wallet. The device shows the wallet name, a summary of the 2-of-3 rule and the three keys. Check that each key’s fingerprint matches your notes, then confirm. Sparrow stores this registration in the wallet file, so if you ever rebuild the wallet from the descriptor, you register again. Then compare the address on its screen with Sparrow.
- Trezor Safe 5: click Display Address as an extra check. Its screen shows the whole address at once, which makes the comparison easy. It doesn’t store your setup, so it’s the least strong of the three checks on its own.
In daily use you won’t do this often. Mostly it’s for the one address you give to an exchange as your withdrawal address, and for anything large.
Different address? Stop
If the device shows a different address from Sparrow, don’t send anything to either address. Check that you unlocked the right wallet (passphrase) and that the descriptor is right. If it still differs, assume the computer is compromised.
Common mistakes
- Comparing only the first and last four characters.
- Handing out an address you haven’t checked on a device that has your multisig registered.
- Skipping the Ledger registration and then wondering why it refuses to sign.