Let users choose the signing address in the Sign Message flow

The Sign Message scene now shows the wallet's receive address in an editable
field instead of a read-only row. Exchanges typically ask a user to prove
control of the specific address they already provided (often a previously-used
one), so the user can replace the default with that address. The wallet must
control whichever address is entered; the plugin signs with the key derived
from that address's stored derivation path and rejects any address it does not
own, surfaced as a clear error. Editing the address clears any prior signature,
and a Use default address link restores the auto-detected receive address.

Author: j0ntz

CHANGELOG.md

@@ -2,7 +2,7 @@
 
 ## Unreleased (develop)
 
-- added: Sign Message option in the wallet list menu for Bitcoin-family wallets, letting users prove self-hosted wallet ownership to exchanges by signing an exchange-provided message.
+- added: Sign Message option in the wallet list menu for Bitcoin-family wallets, letting users prove self-hosted wallet ownership to exchanges by signing an exchange-provided message from a chosen wallet address (defaulting to the current receive address, or a specific address the user enters).
 
 ## 4.49.0 (staging)
 

src/components/scenes/SignMessageScene.tsx

@@ -8,12 +8,13 @@ import { lstrings } from '../../locales/strings'
 import type { EdgeAppSceneProps } from '../../types/routerTypes'
 import { SceneButtons } from '../buttons/SceneButtons'
 import { EdgeCard } from '../cards/EdgeCard'
+import { EdgeTouchableOpacity } from '../common/EdgeTouchableOpacity'
 import { SceneWrapper } from '../common/SceneWrapper'
 import { withWallet } from '../hoc/withWallet'
 import { EdgeRow } from '../rows/EdgeRow'
 import { showError } from '../services/AirshipInstance'
 import { cacheStyles, type Theme, useTheme } from '../services/ThemeContext'
-import { Paragraph, SmallText } from '../themed/EdgeText'
+import { EdgeText, Paragraph, SmallText } from '../themed/EdgeText'
 import { FilledTextInput } from '../themed/FilledTextInput'
 
 export interface SignMessageParams {
@@ -29,23 +30,31 @@ interface Props extends EdgeAppSceneProps<'signMessage'> {
  * self-hosted wallet ownership when withdrawing from a CEX/CASP (EU Travel
  * Rule). BTC-first: the menu entry only appears for UTXO wallets whose plugin
  * implements message signing.
+ *
+ * The signing address defaults to the wallet's current receive address, but is
+ * editable: an exchange usually asks the user to prove control of the specific
+ * address they already provided (often a previously-used one), so the user can
+ * replace the default with that address. The wallet must control whichever
+ * address is entered; the plugin signs with the key derived from that address's
+ * stored derivation path, and rejects any address it does not own.
  */
 const SignMessageSceneComponent: React.FC<Props> = props => {
   const { wallet } = props
 
   const theme = useTheme()
   const styles = getStyles(theme)
 
+  const [address, setAddress] = React.useState('')
+  const [addressTouched, setAddressTouched] = React.useState(false)
   const [message, setMessage] = React.useState('')
   const [signature, setSignature] = React.useState('')
   const [isSigning, setIsSigning] = React.useState(false)
 
-  // The signing address must be one the wallet owns, so we default to the
-  // wallet's own receive address rather than accepting an arbitrary one.
-  // Prefer the native segwit address (the canonical receive address the user
-  // hands the exchange), matching `segwitAddress ?? publicAddress` used
-  // elsewhere; the `publicAddress` type is the wrapped/legacy variant.
-  const { data: publicAddress, error: addressError } = useQuery({
+  // Default to the wallet's own receive address. Prefer the native segwit
+  // address (the canonical receive address the user hands the exchange),
+  // matching `segwitAddress ?? publicAddress` used elsewhere; the
+  // `publicAddress` type is the wrapped/legacy variant.
+  const { data: defaultAddress, error: addressError } = useQuery({
     queryKey: ['signMessageAddress', wallet.id],
     queryFn: async () => {
       const addresses = await wallet.getAddresses({ tokenId: null })
@@ -64,15 +73,33 @@ const SignMessageSceneComponent: React.FC<Props> = props => {
     if (addressError != null) showError(addressError)
   }, [addressError])
 
-  // Clear any prior signature when the message changes, so a stale signature
-  // that no longer matches the message can never be copied.
+  // Seed the editable address with the default once it loads, unless the user
+  // has already typed their own address.
+  React.useEffect(() => {
+    if (!addressTouched && defaultAddress != null) setAddress(defaultAddress)
+  }, [addressTouched, defaultAddress])
+
+  // A signature is bound to both the message and the address, so clear it
+  // whenever either changes to prevent copying a stale signature.
+  const handleChangeAddress = useHandler((text: string) => {
+    setAddressTouched(true)
+    setAddress(text.trim())
+    setSignature('')
+  })
+
+  const handleUseDefaultAddress = useHandler(() => {
+    setAddressTouched(false)
+    if (defaultAddress != null) setAddress(defaultAddress)
+    setSignature('')
+  })
+
   const handleChangeMessage = useHandler((text: string) => {
     setMessage(text)
     setSignature('')
   })
 
   const handleSign = useHandler(async () => {
-    if (publicAddress == null) {
+    if (address === '') {
       showError(lstrings.sign_message_no_address_error)
       return
     }
@@ -83,28 +110,58 @@ const SignMessageSceneComponent: React.FC<Props> = props => {
       // produce a signature over the wrong data, so it is not usable here.
       // eslint-disable-next-line @typescript-eslint/no-deprecated
       const signedMessage = await wallet.signMessage(message, {
-        otherParams: { publicAddress }
+        otherParams: { publicAddress: address }
       })
       setSignature(signedMessage)
     } catch (error: unknown) {
-      showError(error)
+      // The plugin throws when the wallet does not own the address (or it is
+      // malformed). Surface a clear, actionable message for that common case.
+      if (
+        error instanceof Error &&
+        /data-layer address|scriptPubkey|invalid/i.test(error.message)
+      ) {
+        showError(lstrings.sign_message_address_not_owned_error)
+      } else {
+        showError(error)
+      }
     } finally {
       setIsSigning(false)
     }
   })
 
+  const showUseDefault =
+    defaultAddress != null && address !== defaultAddress && !isSigning
+
   return (
     <SceneWrapper scroll>
       <View style={styles.container}>
         <Paragraph>{lstrings.sign_message_instructions}</Paragraph>
 
-        <EdgeCard>
-          <EdgeRow
-            rightButtonType="copy"
-            title={lstrings.sign_message_address_label}
-            body={publicAddress ?? ''}
-          />
-        </EdgeCard>
+        <FilledTextInput
+          aroundRem={0.5}
+          autoCapitalize="none"
+          autoCorrect={false}
+          // Lock the field while signing so the address cannot change mid-flight
+          // and leave the produced signature bound to a different address.
+          disabled={isSigning}
+          placeholder={lstrings.sign_message_address_input_placeholder}
+          testID="signMessageAddressInput"
+          value={address}
+          onChangeText={handleChangeAddress}
+        />
+        <Paragraph>
+          <SmallText>{lstrings.sign_message_address_helper}</SmallText>
+        </Paragraph>
+        {showUseDefault ? (
+          <EdgeTouchableOpacity
+            style={styles.useDefault}
+            onPress={handleUseDefaultAddress}
+          >
+            <EdgeText style={styles.useDefaultText}>
+              {lstrings.sign_message_use_default_address}
+            </EdgeText>
+          </EdgeTouchableOpacity>
+        ) : null}
 
         <FilledTextInput
           aroundRem={0.5}
@@ -138,7 +195,7 @@ const SignMessageSceneComponent: React.FC<Props> = props => {
           primary={{
             label: lstrings.sign_message_sign_button,
             onPress: handleSign,
-            disabled: message === '' || publicAddress == null,
+            disabled: message === '' || address === '',
             spinner: isSigning,
             testID: 'signMessageButton'
           }}
@@ -151,6 +208,15 @@ const SignMessageSceneComponent: React.FC<Props> = props => {
 const getStyles = cacheStyles((theme: Theme) => ({
   container: {
     padding: theme.rem(0.5)
+  },
+  useDefault: {
+    alignSelf: 'flex-start',
+    paddingHorizontal: theme.rem(0.5),
+    paddingBottom: theme.rem(0.5)
+  },
+  useDefaultText: {
+    color: theme.iconTappable,
+    fontSize: theme.rem(0.75)
   }
 }))
 

src/locales/en_US.ts

@@ -297,7 +297,11 @@ const strings = {
   sign_message_title: 'Sign Message',
   sign_message_instructions:
     'Some exchanges ask you to prove you control this wallet by signing a message they provide. Paste the exact message below and sign it with your wallet address, then copy the signature back to the exchange.',
-  sign_message_address_label: 'Wallet Address',
+  sign_message_address_label: 'Signing Address',
+  sign_message_address_input_placeholder: 'Enter or paste the wallet address',
+  sign_message_address_helper:
+    'Defaults to your current receive address. To match a specific address you already gave the exchange, enter it here. This wallet must control the address.',
+  sign_message_use_default_address: 'Use default address',
   sign_message_input_label: 'Message to Sign',
   sign_message_input_placeholder: 'Paste the message from the exchange',
   sign_message_sign_button: 'Sign Message',
@@ -306,6 +310,8 @@ const strings = {
     'Only sign messages from a service you trust. A signature proves you control this address but never reveals your private keys.',
   sign_message_no_address_error:
     'Unable to load a wallet address to sign with.',
+  sign_message_address_not_owned_error:
+    'This wallet does not control that address. Enter an address that belongs to this wallet.',
   fragment_wallets_pubkey_copied_title: 'XPub Address Copied',
   fragment_wallets_export_transactions: 'Export Transactions',
   fragment_wallets_rename_wallet: 'Rename Wallet',

src/locales/strings/enUS.json

@@ -198,13 +198,17 @@
   "fragment_wallets_sign_message": "Sign Message",
   "sign_message_title": "Sign Message",
   "sign_message_instructions": "Some exchanges ask you to prove you control this wallet by signing a message they provide. Paste the exact message below and sign it with your wallet address, then copy the signature back to the exchange.",
-  "sign_message_address_label": "Wallet Address",
+  "sign_message_address_label": "Signing Address",
+  "sign_message_address_input_placeholder": "Enter or paste the wallet address",
+  "sign_message_address_helper": "Defaults to your current receive address. To match a specific address you already gave the exchange, enter it here. This wallet must control the address.",
+  "sign_message_use_default_address": "Use default address",
   "sign_message_input_label": "Message to Sign",
   "sign_message_input_placeholder": "Paste the message from the exchange",
   "sign_message_sign_button": "Sign Message",
   "sign_message_signature_label": "Signature",
   "sign_message_safety_note": "Only sign messages from a service you trust. A signature proves you control this address but never reveals your private keys.",
   "sign_message_no_address_error": "Unable to load a wallet address to sign with.",
+  "sign_message_address_not_owned_error": "This wallet does not control that address. Enter an address that belongs to this wallet.",
   "fragment_wallets_pubkey_copied_title": "XPub Address Copied",
   "fragment_wallets_export_transactions": "Export Transactions",
   "fragment_wallets_rename_wallet": "Rename Wallet",