TL;DR
Register the wallet on the devices that support it, then check a receive address on a device screen. From now on you trust the device screen, not the computer.
What you need
Sparrow runs on a computer, and computers can be tampered with. A hardware wallet that knows your multisig setup can calculate the address itself and show it on its own screen. If that matches what Sparrow shows, the address really belongs to your wallet.
Steps
- Open the Receive tab in Sparrow.
- BitBox02: connect it, click Display Address and confirm on the device when it asks to register the multisig. It remembers this permanently.
- Ledger: Sparrow asks you to register the wallet policy the first time you use it with this wallet. The device shows the wallet name, a summary of the 2-of-3 rule and the three keys. Check that each key’s fingerprint matches your notes, then confirm. Sparrow stores this registration in the wallet file, so after reinstalling Sparrow you do it again.
- Trezor Safe 5: it doesn’t store the setup, Sparrow sends it along each time. Click Display Address.
- Compare the address on the Trezor with Sparrow, every character. The Safe 5 shows the whole address on one screen, which is why it’s my main device for this.
- For extra certainty, repeat on one of the other two devices.
In daily use you won’t do this often. Mostly it’s for the one address you give to an exchange as your withdrawal address, and for anything large.
Different address? Stop
If the device shows a different address from Sparrow, don’t send anything to either address. Check that you unlocked the right wallet (passphrase) and that the descriptor is right. If it still differs, assume the computer is compromised.
Common mistakes
- Comparing only the first and last four characters.
- Handing out an address you haven’t checked on a device.
- Skipping the Ledger registration and then wondering why it refuses to sign.