Problem with Yoroi/ADA and Trezor Model T

Third party wallets
, , ,
1

Hello.

I am having a serious issue with an ADA Trezor wallet created using Yoroi and I see several people with the same issue. I’m hoping you can help solve it for us. Here are some threads describing the issue:

Long story short:

  • I have used the Yoroi extension in Brave together with my Trezor Model T to create an ADA wallet.

  • I used the passphrase feature and entered the passphrase on my physical device when creating the account. The wallet was derived from my Trezor and its passphrase, I did not get a seed phrase for the ADA/Yoroi wallet nor any spending password.

  • I received and staked ADA.

  • Now I cannot restore the account on either Yoroi or Adalite by simply using the Trezor and passphrase. All I get are empty accounts with different public keys. If I try making any actions in my Yoroi wallet using the Trezor I get the error “Change address staking rights do not match the current account” (presumably because the public key is different).

(FWIW the wallet was created in February and I didn’t try restoring until at least 5-6 months later. In case any update to software or firmware may be an issue, this might be relevant).

I have contacted Yoroi support but they essentially think it’s due to a user error. Which I’m very sure it’s not, because I have only one passphrase and I’m sure I have entered it correctly. And several people have a very similar issue with specifically Trezor and Yoroi. So there has to be something more to it. As is, I can’t restore the wallet with funds in it nor perform any action on the account, so my ADA are stuck.

Any idea what the problem could be? Or what I could try? (I did try disabling the passphrase function, that didn’t help).

Thank you very much.

2

Two more threads with the same issue (can only post 4 links at once):

4

Hey guys, I’m in big trouble and it seems to be a bug happening to more people too.

My Trezor does not restore the correct Cardan wallet. I restored my Yoroi in another browser but when I try to connect the Trezor it restores a new wallet with no balance instead of my previous one. I am unable to restore my old wallet at all. I tried connecting it to adalite but it’s also no showing my assets there.

I don’t use any passphrase but I already tried passing the fields in blank and nothing works. I also tried to downgrade the firmware but had no success as well.

My old wallet with 1264 ADAS is this one (Address addr1qy50fmy78vvaledg5mx739mh08kkg465346a3tkkwmvpj4752vnhkvkxyvhzg40rc2g8gdrmw3vgp0cdskmx74juus9s37rqad - Cardanoscan)

The new wallet that is restoring without balance (addr1q829ahzwsdc5tp2d5y7dn3ahtycm997jpmx5wepv4wlencuvln6u6zqafttwvxpzu39zqtqjwr0z0sr43g7vht3qdu4s63f4mg)

Again, in my Trezor suite I always used a single account (always same seeds) with no passphrase.

Thanks in advance.

5

Hi,

I have the same issue as you do. Hope we can find some help here.

6

Hello guys,

Sorry to hear that you have been experiencing such issues.

Generally, when the same recovery seed is entered (and the same passphrase is used), the same wallet is accessed. There is no exception. If you have entered the same recovery seed (and the same passphrase if used), you it would generate the same wallet including the same accounts having the same addresses in the same order. The public-key cryptography ensures it generates always the same result.

Hence, if you cannot see your address, then a different combination of seed and passphrase has been used.

7

Actually, it doesn’t happen on Yoroi wallet. When we connect Trezor there, it doesn’t ask for any seed or passphrase, it just goes straight ahead with a different address. On the other hand when we try on Metamask for example, once we connect Trezor there it asks which wallet we want to proceed with (it’s a Trezor screen), the same doesn’t happen to Yoroi. I think that choice screen is missing there, there is no way I can select a wallet, it goes always to the same wrong one. Thanks in advance.

8

Sounds to me that Yoroi doesn’t do it correctly then. When you connect a Trezor to a third party wallet, the wallet is supposed to use Trezor Connect for this operation. Check if your Trezor Bridge is updated to the newest version and running (you should see “trezord” process with Task Manager) and its status at http://127.0.0.1:21325/status/.

9

It seems that it’s Yoroi users complaining about this problem, I haven’t seen any reports of similar thing happening to Adalite users. This leads me to think that maybe Yoroi has an issue.

You should be able to confirm that you get the same receiving address from Adalite and from Yoroi when using your Trezor. We actually have automatic tests that check that the addresses do not change between firmware updates.

So there are several possibilities what’s going on:

  • your seed is written down wrong, and you restored a different wallet
    • if you have any other cryptocurrency and it is showing up correctly on the restored Trezor, that’s not the case
  • you have previously used a passphrase and now you’re not (or you’re entering a different one) or you have previously NOT used a passphrase, and are entering one now
    • at least @ADAproblems claims that their passphrase is definitely correct
    • @tiaguinhow, please keep in mind that passphrase in Suite and passphrase for Yoroi don’t need to be the same thing. It is very much possible to NOT use passphrase in Suite, but use one in Yoroi, if that’s how you originally configured the wallet. Of course, if you didn’t have passphrase originally either, then it’s correct to enter blank values.
  • Yoroi is now using different derivation paths than it was before. Again, Adalite users haven’t complained about this problem, so :woman_shrugging: . It would be nice to try to downgrade the Yoroi extension, but I don’t know if that’s possible.
10

Regarding the “staking rights do not match” message, it’s pretty much what it says on the cover:

Your Cardano address consists of “base” part and “staking” part. For Trezor, it is only possible to specify the “base” part in the format of “13th address of 1st account of Trezor” (i.e., as a derivation path).
It is possible to specify the “staking” part in the same way (“13th staking address of 1st account of Trezor”), or you can provide a key hash, which can be any address on the network (including yours).

If you specify a base path, and provide a staking key hash, Trezor takes the base path, computes the matching stake path (so from “13th address” to “13th staking address”) and calculates the expected key hash. If the expected key hash is the same as the wallet sent, all is well. If not, you get the “mismatch” warning.

It’s honestly somewhat weird that Yoroi would do this (set staking key hash instead of staking path) in the first place.
It’s possible that Yoroi does this when it thinks the Trezor doesn’t match the current account – or it might be a bug, or even some malware.

11

It seems to be a bug indeed, but I’m not sure on what side if it’s Trezor or Yoroi because not even adalite or any other wallet is recognising the old Trezor wallet address. And I also see so many people complaining about the same issue in so many places and forums (like this one Yoroi Trezor "Change address staking rights..." sending problem - #19 by ADAproblems - Community Technical Support - Cardano Forum) and nobody does anything. We are talking about money and security here, how can it be reliable? I’m no longer confident with Trezor nor Yoroi, it’s being a rock on my path for so long and I have no clue on what to do.

12

Well, you could wait until November, when ADA is supported in Trezor Suite, and avoid using a third party wallet altogether. That’s what I do anyway.

13

Thank you for very much your replies @Petosiris @matejcik @ pavel.

I tried some brief troubleshooting based on your responses:

  • Trezor bridge is installed and running correctly.
  • Yoroi and Adalite show the same accounts when entering no passphrase, or several different passphrases (whether the one I did use initially, or a random one).
  • The Trezor seed is 100% correct, the only one ever used and all other coins are correctly shown.

Just as @ tiaguinhow says, even when restoring/importing from the same Trezor (in my case with passphrase, in his case without) using another platform e.g. Adalite, the accounts we see are not the one that was initially created when we connected our Trezor to Yoroi. Now all I get are zero balance accounts that I have never used.

Can we narrow the problem down further based on this? Is it possible that Yoroi at first imported a different account (even though I used the same Trezor and passphrase) because of the way it derives the address? (Don’t know the technical bit here so please bear with me).

Clearly the account I did use is derived from my Trezor and the passphrase that I used. So that in combination with some mechanism should be able to restore that same account, right? But how many ways of doing this are there even, and would Yoroi’s differ? There should be some way to narrow down the issue here.

Currently I can still see my account with funds in it but that’s only because it’s stored locally in Yoroi. And as mentioned, I can’t perform any action on it nor restore it anywhere else (not on different pc or browser). So I can see the address and what I was told by support is the checksum (4 letters and 4 numbers) and also the derivation path. Would sharing the derivation path (or anything else) be of use?

I see now that the derivation path is the same for the initial account with funds in it, and all the empty accounts that show up when I try to restore it with the correct passphrase / without passphrase / with a random passphrase. It is m/1852’/1815’/0’. No idea if that helps you.

Greatly appreciate your help and further suggestions. Thank you.

1 Like
14

If you have multiple coins, and are able to restore all of them correctly with the right seed and passphrase, it is overwhelmingly likely that this is a problem of Yoroi, not of Trezor. Again, we have automated tests confirming that derived addresses do not change between firmware versions. And the fact that other coins did appear indicates that the seed or passphrase is not the issue here.

In theory, yes.
It would be nice to know that you did originally verify your address on Trezor screen, it matched, and now when you try to do the same thing, it also matches (even if it is different from before). If that’s the case, we could be sure that the address is generated by Trezor.
If you originally didn’t do that, there is a distinct possibility that the addresses in your old Yoroi installation didn’t in fact come from Trezor.

Also keep in mind that there are multiple addresses tied to your account. If you go to Receive tab in Yoroi, you can click the “verify address” and see the full derivation path (m/1852'/1815'/0' is only a prefix, the full address should have something like /0/4 tacked on end).

How many receiving addresses with non-zero balance do you have? Check both the “External” and “Internal” tabs. What are their suffixes?
Can you see the same address indexes in the restored Yoroi? If not, try clicking “Generate new address” enough times so that you get to the right indexes. There is a small chance that the old Yoroi generated more addresses than the new one, and you can “generate” your way to the right ones. In any case, addresses with the same index should be the same. If they aren’t, we still haven’t hit the right problem.

Can you use the Export feature to see the old account on e.g. Yoroi Mobile?

Does the public key exported by the old Yoroi match what Adalite is showing? Perhaps not Shelley key but Byron key?

If none of this helps, I’m afraid that you’ll have to turn to Yoroi support again. As I said previously, a nice thing to do would be to get an older version of Yoroi and see if that doesn’t magically fix the problem.

15

Thank you very much for your comprehensive response and trying to help, I really appreciate it.

If you have multiple coins, and are able to restore all of them correctly with the right seed and passphrase, it is overwhelmingly likely that this is a problem of Yoroi, not of Trezor. Again, we have automated tests confirming that derived addresses do not change between firmware versions. And the fact that other coins did appear indicates that the seed or passphrase is not the issue here.

Yes. Well I am simply using my Trezor and passphrase as normal in e.g. Trezor Suite or Metamask and I can access all my other coins and use them as normal. I never actually had to restore the wallets using my seed, but that should be irrelevant in this case right.

It would be nice to know that you did originally verify your address on Trezor screen, it matched, and now when you try to do the same thing, it also matches (even if it is different from before). If that’s the case, we could be sure that the address is generated by Trezor.
If you originally didn’t do that, there is a distinct possibility that the addresses in your old Yoroi installation didn’t in fact come from Trezor.

When I connect my Trezor via Adalite or Yoroi there is no prompt on the physical Trezor to do anything. What happens is:

  1. Webpage opens up: TrezorConnect | Trezor Asking for permission to read public keys from Trezor device. I click “Allow once for this session”
  2. Export multiple Cardano public keys. I click “Export”
  3. Enter Trezor passphrase. I enter it on my physical device.

That’s it. Then the account is loaded into Yoroi/Adalite. Though when I tried pairing my Trezor with Daedalus I do have to verify the public key on the physical Trezor and click the green checkbox to proceed.

If the address didn’t come from the Trezor, then where could it have come from? Also in Yoroi it does say “Trezor Wallet” with an image of a Trezor next to it, up top, suggesting it is indeed derived from my Trezor.

How many receiving addresses with non-zero balance do you have? Check both the “External” and “Internal” tabs. What are their suffixes?

On the original account with funds on it (that I can’t restore or transact with) there are 2 external addresses with funds on them, and 2 internal. By suffix I assume you mean the end of the derivation path?
External:
m/1852’/1815’/0’/0/2
m/1852’/1815’/0’/0/1
Internal:
m/1852’/1815’/0’/1/1
m/1852’/1815’/0’/1/0

I should also note that when I click verify address to see this, I can see that all these addresses have a respective “Staking key hash” and “Spending key hash”. On the newly derived empty accounts each address only has “Staking key hash”. I don’t know if that is relevant.

Using the same Trezor and only passphrase in Yoroi / Adalite generates empty accounts, as said. I can generate more receive addresses to get more derivation paths. But the ones with the same paths (e.g. m/1852’/1815’/0’/0/2) are still empty and the addresses are different from those in the original account.

Can you use the Export feature to see the old account on e.g. Yoroi Mobile?

Yes, I can use the Export feature in Yoroi and it gives me a QR code which when I scan produces the same original wallet in Yoroi Mobile, with the correct amount of funds.

The public key on my original account (that I can see in Yoroi using Export) is not the same as any of the keys that I see in Adalite when connecting to what should be the same account (same Trezor, same passphrase) but is an empty unused one.

I’m not sure how I can find the Byron/Shelley extended public keys in Yoroi but I suppose this is enough to say that it’s not the same account?

If none of this helps, I’m afraid that you’ll have to turn to Yoroi support again. As I said previously, a nice thing to do would be to get an older version of Yoroi and see if that doesn’t magically fix the problem.

I’ll try to get my hands on an older version of Yoroi and give that a try.

Anyway, with several other users having the same problem with Yoroi and Trezor specifically, and some not even having used a passphrase (no risk of having misspelled something), there has to be a problem somewhere, and a solution too. I’ll see if Yoroi support responds with anything, last time they basically assumed it was a user error (which is not unreasonable to assume, I guess).

Again, thank you very much for your help.

1 Like
16

On the “verify address” screen, you can click a button to show the address on Trezor screen. You should actually always be doing this! Otherwise malware can simply modify the address on your PC screen. (It can still mess with you by showing “good” address on screen but using bad one under the hood, but it’s more difficult to implement and known existing malwares don’t bother)

This is definitely worth noting, and it might be a pointer to what the issue is.
(FWIW for me Yoroi shows both, for an account that is the same on Adalite)

17

Hey guys, I’m not sure if this is somehow helpful, but I can see my previous wallet is with the status Not Active, what does it mean? Stake Key d453277b32c6232e2455e3c29074347b745880bf0d85b66f565ce40b - Cardanoscan

Thanks in advance.

18

Thanks again for your continued support @matejcik

On the “verify address” screen, you can click a button to show the address on Trezor screen. You should actually always be doing this! Otherwise malware can simply modify the address on your PC screen. (It can still mess with you by showing “good” address on screen but using bad one under the hood, but it’s more difficult to implement and known existing malwares don’t bother)

Well that is certainly good to know. But during which stage of the process should this be done? When receiving coins and having the option inside Yoroi to verify the address it makes sense. But when you import the wallet in the first place you’re not given an option to do so in either Yoroi or Adalite. You simply get the two screens where you accept to export the public keys. Just like in this video (at included timestamp): How to Stake ADA with Yoroi using Trezor Model T - YouTube Never do you see your public key or have any option to interact with the physical Trezor. Is this not how it should be? (Though as mentioned, on Daedalus you are prompted to verify the public key on the physical Trezor).

This is definitely worth noting, and it might be a pointer to what the issue is.
(FWIW for me Yoroi shows both, for an account that is the same on Adalite)

Okay. I really don’t know how to progress from here. I’ve contacted Yoroi support again but they didn’t reply for since 4 days ago. Do you have any further ideas what I could try? And it seems quite certain that the problem is not with Trezor but with Yoroi?

19

You should be doing this whenever you want to give the receiving address to someone.
There’s no point in doing it when the wallet is imported – but if you originally did this when receiving your coins, we would at least be certain that the address that holds the coin is really generated by Trezor.

From where I’m standing, there’s two possibilities:

(a) You got the wrong passphrase. Again, this is by far the most common answer to a problem such as this one.
I believe you if you say that’s not the case :slight_smile: But please think hard and consider this option too. It is possible to use one passphrase for Yoroi and a different one for Suite (or any other wallet app). There is no cross-check, using multiple different passphrases is a supported scenario, so you wouldn’t even see any kind of warning.
If you have other coins on the same seed+passphrase, and you had them at the time that you got your ADA, and you’re entering the passphrase on device, and you’re sure that it’s always the same one, it’s a strong indication that it is the right passphrase. Still, please do consider this option. Upper/lowercase letters matter, etc.

(b) Something changed in the way Yoroi handles accounts, and/or your account was not actually generated from Trezor.

Although it’s not impossible, I currently don’t see any way a problem in Trezor could cause this.
At this point, without a way to reproduce the issue myself, I can’t help you further. Please let us know if you get anywhere with Yoroi support.

20

You should be doing this whenever you want to give the receiving address to someone.
There’s no point in doing it when the wallet is imported – but if you originally did this when receiving your coins, we would at least be certain that the address that holds the coin is really generated by Trezor.

Yes. A bit unfortunate that it’s not forced like when you request a receiving address in Trezor suite (have to verify it on physical Trezor before seeing the address).

(a) You got the wrong passphrase. Again, this is by far the most common answer to a problem such as this one.

Yes. Clearly this is most likely. Though I’m very sure I did get it right and all your points below are true (one phrase, all other coins are there, etc). The fact that other users that did not use a passphrase still have the same issue seems to support that there is indeed a problem with Yoroi, somehow. If you only use your one Trezor and no passphrase and don’t mistakenly create a standard wallet that you get a seed for, how could a user error even get it wrong?

(b) Something changed in the way Yoroi handles accounts, and/or your account was not actually generated from Trezor.
Although it’s not impossible, I currently don’t see any way a problem in Trezor could cause this.
At this point, without a way to reproduce the issue myself, I can’t help you further. Please let us know if you get anywhere with Yoroi support.

I do wonder how Yoroi could manage to create an account that is not derived from the Trezor, when even going through the Trezor page and importing it as called “Trezor wallet”. Do you have any idea how such a big error could occur?

In any case, thank you very much for your assistance thus far. At this point it seems to be in the hands of Yoroi support. Unfortunately they have been fairly slow to reply (6 days without reply as of now), but I can understand that they have lots to do. I’m just hoping they will acknowledge this issue and fully investigate it, and not write it off as a series of user errors.

@tiaguinhow When did you create your original wallet that you can no longer access? I did it in February. Maybe this is relevant in case something has changed in Yoroi since then.

Hey guys, I’m not sure if this is somehow helpful, but I can see my previous wallet is with the status Not Active , what does it mean?

I’m just guessing, but maybe it means you haven’t staked your ADA? On my address the ADA is staked and it does say “Active”.

21

This particular problem is, unfortunately, rather easy to hit:
When you restore your seed using Trezor Suite, the passphrase feature on Trezor is auto-enabled. Suite does the smart thing and presents you with Standard/Hidden wallet selector. This is currently missing from Connect (the popup thing that handles Yoroi integration), so out of nowhere Yoroi is asking you for a passphrase. A typical user will just “set a passphrase” without much thought. This creates a new Trezor wallet with zero funds.

You need to know that you’re supposed to leave the passphrase fields empty and just hit Enter. @tiaguinhow seems to know this, so it should not be the issue at hand. Still, you can see how this can happen.

2 Likes