If this type of attack happened to an Anchorwatch wallet, resulting in loss of funds, would it be covered by Lloyd’s?
Listening to nostr:nprofile1qqs879mhq6kkuzh2wk57xdzanl76uem8d7hlyjd7v4a4jcm4u88d8ygpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgqgewaehxw309aek2mnyd96zumn0wdnxcctjv5hxxmmdrhn42m, nostr:nprofile1qqsqfjg4mth7uwp307nng3z2em3ep2pxnljczzezg8j7dhf58ha7ejgprpmhxue69uhhqun9d45h2mfwwpexjmtpdshxuet5qyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqnz0fd0 is right in his critiques around approving a given miniscript policy.
The diffferenced though in the context of bybit are:
1. Validating a descriptor is a one time function, versus in eth it’s every time.
2. Having established templates would go a long way to have HWW UX attest to a specific format so it doesn’t have to be raw output descriptor text
3. Most users doing multisigs i know of are not checking XPUB integrity, not miniscript specific, just important context.
4. Bigger screens do help, but still require miniscript knowledge today to verify. Best option in my opinion is do a breakout of ways money can be spent in a list, but needs a group effort and peer review before it got integrated anywhere.
5. At AnchorWatch, we specifically review the output descriptor prior to finalizing a customer onboarding for integrity checks, maybe the way to facilitate adoption is open source tooling around this.
Discussion
I'm not even sure what "attack" you're referring to in this circumstance?