You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* first draft remediation of CIP-0021
* fixed formatting of sub-sub-subheadings and admonitions
* standardised use of "ledger era" as per CIP-0084
* spelled NA instead of standard N/A
This CIP describes all the restrictions applicable to Cardano transactions which need to be signed by hardware wallets.
14
20
15
-
## Motivation
21
+
## Motivation: why is this CIP necessary?
16
22
17
23
Due to certain limitations of hardware (abbrev. HW) wallets, especially very small memory and a limited set of data types supported by Ledger, HW wallets are not able to process all valid transactions which are supported by Cardano nodes.
18
24
@@ -26,7 +32,7 @@ To ensure interoperability, SW wallets and other tools working with HW wallets s
26
32
27
33
Certain transaction elements, described as allowed in this document, might not be supported by some HW wallets. Support also depends on HW wallet firmware or app versions. If transaction signing fails for a transaction which is built according to this specification, make sure to check the documentation of the HW wallet you are using.
28
34
29
-
_It might take some time for recent Cardano ledger spec changes to be implemented for HW wallets. Thus it might happen that further restrictions might apply on top of the restrictions mentioned in this CIP until the changes are implemented on HW wallets._
35
+
> **Note:** It might take some time for recent Cardano ledger spec changes to be implemented for HW wallets. Thus it might happen that further restrictions might apply on top of the restrictions mentioned in this CIP until the changes are implemented on HW wallets.
30
36
31
37
### Canonical CBOR serialization format
32
38
@@ -41,15 +47,15 @@ See the RFC for details.
41
47
42
48
### Transaction body
43
49
44
-
**Unsupported entries**
50
+
#### Unsupported entries
45
51
46
52
The transaction body entry `6 : update` must not be included.
47
53
48
-
**Integers**
54
+
#### Integers
49
55
50
56
HW wallets support at most `int64` for signed integers and `uint64` for unsigned integers i.e. larger integers are not supported overall. Additionally, any integer value must fit in the appropriate type.
51
57
52
-
**Numbers of transaction elements**
58
+
#### Numbers of transaction elements
53
59
54
60
The number of the following transaction elements individually must not exceed `UINT16_MAX`, i.e. 65535:
55
61
@@ -66,27 +72,27 @@ The number of the following transaction elements individually must not exceed `U
66
72
- reference inputs in transaction body
67
73
- the total number of witnesses
68
74
69
-
**Optional empty lists and maps**
75
+
#### Optional empty lists and maps
70
76
71
77
Unless mentioned otherwise in this CIP, optional empty lists and maps must not be included as part of the transaction body or its elements.
72
78
73
-
**Outputs**
79
+
#### Outputs
74
80
75
-
A new, "post Alonzo", output format has been introduced in the Babbage era which uses a map instead of an array to store the output data. For now, both the "legacy" (array) and "post Alonzo" (map) output formats are supported by HW wallets but we encourage everyone to migrate to the "post Alonzo" format as support for the "legacy" output format might be removed in the future. Both formats can be mixed within a single transaction, both in outputs and in the collateral return output.
81
+
A new, "post Alonzo", output format has been introduced in the Babbage ledger era which uses a map instead of an array to store the output data. For now, both the "legacy" (array) and "post Alonzo" (map) output formats are supported by HW wallets but we encourage everyone to migrate to the "post Alonzo" format as support for the "legacy" output format might be removed in the future. Both formats can be mixed within a single transaction, both in outputs and in the collateral return output.
76
82
77
-
_Legacy outputs_
83
+
##### Legacy outputs
78
84
79
85
Outputs containing no multi-asset tokens must be serialized as a simple tuple, i.e. `[address, coin, ?datum_hash]` instead of `[address, [coin, {}], ?datum_hash]`.
80
86
81
-
_Post Alonzo outputs_
87
+
##### Post Alonzo outputs
82
88
83
89
If the `data` of `datum_option` is included in an output, it must not be empty. `script_ref` (reference script) must also not be empty if it is included in an output.
84
90
85
-
**Multiassets**
91
+
#### Multiassets
86
92
87
93
Since multiassets (`policy_id` and `asset_name`) are represented as maps, both need to be sorted in accordance with the specified canonical CBOR format. Also, an output or the mint field must not contain duplicate `policy_id`s and a policy must not contain duplicate `asset_name`s.
88
94
89
-
**Certificates**
95
+
#### Certificates
90
96
91
97
Certificates of type `genesis_key_delegation` and `move_instantaneous_rewards_cert` are not supported and must not be included.
92
98
@@ -107,7 +113,7 @@ Certificate stake credentials must be:
107
113
- only script hashes in multi-sig transactions.
108
114
(There is no restriction for transactions involving Plutus.)
109
115
110
-
**Withdrawals**
116
+
#### Withdrawals
111
117
112
118
Since withdrawals are represented as a map of reward accounts, withdrawals also need to be sorted in accordance with the specified canonical CBOR format. A transaction must not contain duplicate withdrawals.
113
119
@@ -116,7 +122,7 @@ Withdrawal reward accounts must be:
116
122
- only based on script hashes in multi-sig transactions.
117
123
(There is no restriction for transactions involving Plutus.)
118
124
119
-
**Auxiliary data**
125
+
#### Auxiliary data
120
126
121
127
HW wallets do not serialize auxiliary data because of their complex structure. They only include the given auxiliary data hash in the transaction body. The only exception is Catalyst voting registration because it requires a signature computed by the HW wallet.
122
128
@@ -128,7 +134,7 @@ In this exceptional case, auxiliary data must be encoded in their "tuple" format
128
134
129
135
The `auxiliary_scripts` must be an array of length 0.
130
136
131
-
## Reasoning
137
+
## Rationale: how does this CIP achieve its goals?
132
138
133
139
### Canonical CBOR serialization format
134
140
@@ -138,30 +144,38 @@ The specified canonical CBOR format is consistent with how certain other data ar
138
144
139
145
### Transaction body
140
146
141
-
**Multiassets**
147
+
#### Multiassets
142
148
143
149
Allowing duplicate `policy_id`s (or `asset_name`s) might lead to inconsistencies between what is displayed to the user and how nodes and other tools might interpret the duplicate keys, i.e. all policies (or asset names) would be shown to the user, but nodes and other tools might eventually interpret only a single one of them.
144
150
145
-
**Certificates**
151
+
#### Certificates
146
152
147
153
Combining withdrawals and pool registration certificates isn't allowed because both are signed by staking keys by pool owners. If it was allowed to have both in a transaction then the witness provided by a pool owner might inadvertently serve as a witness for a withdrawal for the owner's account.
148
154
149
-
**Withdrawals**
155
+
#### Withdrawals
150
156
151
157
Similarly to multiassets, allowing duplicate withdrawals might lead to inconsistencies between what is displayed to the user and how nodes and other tools might interpret the duplicate keys.
152
158
153
-
**Auxiliary data**
159
+
#### Auxiliary data
154
160
155
161
The specified auxiliary data format was chosen in order to be compatible with other Cardano tools, which mostly use this serialization format.
156
162
157
-
## Backwards compatibility
163
+
###Backwards compatibility
158
164
159
165
Tools interacting with HW wallets might need to be updated in order to continue being compatible with HW wallets because of canonical CBOR serialization format, which is being enforced since multi-sig support.
160
166
161
-
## Tools
167
+
## Path to Active
162
168
163
-
[`cardano-hw-interop-library`](https://github.com/vacuumlabs/cardano-hw-interop-lib) or [`cardano-hw-cli'](https://github.com/vacuumlabs/cardano-hw-cli) (which uses the interop library) can be used to validate or transform transactions into a HW wallet compatible format if possible.
169
+
### Acceptance Criteria
170
+
171
+
-[x] Confirmation (by default if no ongoing incompatibilities) since Alonzo ledger era that this interoperability between software and hardware wallets has been generally achieved.
172
+
173
+
### Implementation Plan
174
+
175
+
-[x] Tools exist which can be used to validate or transform transactions into a HW wallet compatible format if possible:
0 commit comments