2-of-3 multisig with 2FA: Show service xpub (per-account) for faster recovery

[Tracachang]

In the Blockstream app, when creating a 2-of-3 wallet with 2FA enabled, the resulting wallet does not display the xpub for the 2-of-3 account after account creation.

This xpub is required for restoring/recovering the wallet using the garecovery tool: https://github.com/Blockstream/garecovery
I found this documented via: https://help.blockstream.com/blockstream-app/manage-2fa-accounts/2fa-multisig-protection-explained

After creation, there appears to be no way to retrieve or view that xpub within the app.
Steps to Reproduce

Open the Blockstream app.
Create a new wallet configured as 2-of-3 with 2FA enabled.
Complete account creation (no xpub is displayed).
Log in again and open the wallet/account options:
    Select the 2-of-3 account → 3 dots → Watch-only
Observe that watch-only credentials (email and password) can be updated or deleted.

Expected Result

The app should show the xpub (or provide an option to export/retrieve it) for the 2-of-3 + 2FA account, and clearly warn that the xpub is important to keep in order to restore the wallet using garecovery.

Actual Result

For 2-of-3 with 2FA, the app does not display the xpub. The watch-only flow is limited to managing email/password credentials, and I do not see any way to obtain the xpub required for garecovery.

Additionally, when using a Jade HW for multisig with third parties (e.g., via Sparrow), the xpub is registered on the hardware device itself under its options → wallet → registered wallets area. However, this does not appear to be the case when creating a 2-of-3 + 2FA multisig using the Blockstream app.

[ardier16]

@Tracachang thanks for flagging this! We agree that the xpub required for 2-of-3 recovery should be available in the app and accompanied by clear backup guidance. We’ll keep this issue open while we add a way to view or export it.

[domegabri]

Hello @Tracachang , as you can see here: https://github.com/Blockstream/garecovery/blob/d6f4112b848a9f1449f6ac4bdf19736e705300d1/garecovery/tests/test_ga_xpub.py#L35

The --search-subaccounts=x option searches the first x subaccounts and derives the possible Green service xpubs needed to locate any 2-of-3 accounts.

Recovery therefore remains possible without providing --ga-xpub, although the search may take longer.

I am going to edit this issue to include the service xpub for each subaccount so users who keep this data can take advantage of a faster recovery.

Garecovery documentation will also be updated to clarify this point.