TimelockRecovery Plugin - failed after signing the first transaction

[oren-z0]

Describe the bug
Using Specter 2.1.8 on Umbrel, after successfully signing the first transaction (with a simulator of a hardware device), I clicked "Next" and got the following crash:

http://localhost:25441/svc/timelockrecovery/step4?wallet=simulator_wallet_with_passphrase

version: v2.1.8
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/site-packages/flask/app.py", line 1823, in full_dispatch_request
    rv = self.dispatch_request()
  File "/usr/local/lib/python3.10/site-packages/flask/app.py", line 1799, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
  File "/usr/local/lib/python3.10/site-packages/flask_login/utils.py", line 290, in decorated_view
    return current_app.ensure_sync(func)(*args, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/cryptoadvance/specter/services/controller.py", line 43, in wrapper
    return func(*args, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/oren-z0/specterext/timelockrecovery/controller.py", line 223, in step4_post
    recovery_psbt.to_base64(),
  File "/usr/local/lib/python3.10/site-packages/embit/psbt.py", line 661, in to_base64
    return b2a_base64(self.serialize()).strip().decode()
  File "/usr/local/lib/python3.10/site-packages/embit/base.py", line 45, in serialize
    self.write_to(stream, *args, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/embit/psbt.py", line 621, in write_to
    tx = self.tx.serialize()
  File "/usr/local/lib/python3.10/site-packages/embit/base.py", line 45, in serialize
    self.write_to(stream, *args, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/embit/transaction.py", line 82, in write_to
    res += out.write_to(stream)
  File "/usr/local/lib/python3.10/site-packages/embit/transaction.py", line 359, in write_to
    res = stream.write(self.value.to_bytes(8, "little"))
AttributeError: 'float' object has no attribute 'to_bytes'

It didn't happen on version 2.1.7 with a hot wallet. I'm starting to investigate.

[oren-z0]

The bug happens when the BTC unit display is selected. Probably one of the fields is passed as BTC float instead of sats.

[al-munazzim]

Thanks for the report — I looked into this.

Root cause: Specter Desktop v2.1.8 pins specterext-timelockrecovery==0.2.1. In that version the Step 2 form could serialize recovery recipient amounts as BTC-derived JavaScript floats (for example from amount * 1e8). Those values were then passed directly into embit TransactionOutput, which expects integer satoshis and later crashes during serialization with:

AttributeError: 'float' object has no attribute 'to_bytes'

This appears to already be fixed in TimelockRecovery v0.2.3: the frontend now uses Math.round(...) when converting BTC amounts to sats, and Specter Desktop master has already bumped the bundled dependency to specterext-timelockrecovery==0.2.3 in #2620.

I also opened a small defense-in-depth PR on the extension so stale/malformed float payloads are normalized to integer sats at the server-side PSBT construction boundary before they reach embit:

oren-z0/timelockrecovery-specter#2

Verification I ran locally for that hardening patch:

• python3 -m py_compile src/oren-z0/specterext/timelockrecovery/controller.py
• focused helper probe confirming 100000.0 -> 100000, 28999999.999999996 -> 29000000, and invalid values such as bool/negative/NaN/inf/string are rejected.

So for Specter itself the actionable fix is to ship/use a build that includes the v0.2.3 dependency bump; the extension PR just makes the same class of crash harder to reintroduce.

[k9ert]

@al-munazzim so the real problem is that umbrel does ship an old specter-desktop and we should update it?! However, seems that the newest version is already available: getumbrel/umbrel-apps@530f568

@oren-z0 Can't you update on umbrel? Not sure how it exactly works.

[oren-z0]

If you updated the Umbrel app on the app store, then this issue should be fixed now.