CommitWatch RSS
O
← Developer activityStrong match

odudex

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

122 commits3 monitored projects43 candidates3 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to odudexA visual map of monitored and externally discovered repositories.Odeveloper118Krux2Blockstream Jade2libwally-core
Monitored evidence

CommitWatch projects

KruxKrux118 commits43 candidates3 high riskBlockstream JadeBlockstream2 commits0 candidates0 high risklibwally-coreElements Project2 commits0 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack
d6813d88by odudex+52−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed
518b3314by odudex+159−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 82 · Strong
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with Shannon changes and RNG removal

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is …

Commit message explicitly mentions fixing a heap overflowRemoval of an unused cryptographic/randomness binding (os.urandom)Submodule bump only; no source-level patch visible in this commit
5c4ece9aby odudex+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 52 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: remove Maix Bit and CIF camera support

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVG…

Buffer overflow / scratch buffer overflow claimed in commit message (49,152 bytes)Removal of vulnerable hardware code path rather than hardening the entropy moduleDiscontinuation of affected device reduces real-world exposure
8090ac73by odudex+11−1279 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

refactor: use native uUR on tests and simulator

This commit is a routine engineering cleanup: it removes a Python-only compatibility layer (a 'shim') used for testing and simulation, and makes the test environment use the same C-language UR encoder/decoder module that the real hardware …

2fe2f5f5by odudex+108−24919 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

test: build embit's C libsecp256k1 for tests

This commit only changes how automated tests are run. It builds a C cryptography library during testing so the test environment matches the real firmware more closely. There is no change to the actual Krux firmware or wallet code, and no s…

ac3ea482by odudex+37−03 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

docs: self-host math, remove MathJax/require.js CDN

This change removes third-party web scripts (MathJax and require.js loaded from a content delivery network) from the project's documentation and replaces them with self-hosted, pre-rendered math images. That eliminates a supply-chain risk …

Removal of cdnjs MathJax and require.js external script loadsSelf-hosting of rendered math assets as static SVGsExplicit commit message reference to supply-chain class (polyfill.io incident)
492820a1by odudex+8779−8928 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

feat: migrate UR encoding to uUR MicroPython C module

This commit swaps out the pure-Python QR code encoding/decoding libraries used by the Krux hardware wallet for a new C module called uUR. The stated goal is faster scanning and lower memory use. The change touches code that handles Bitcoin…

Large-scale dependency swap in cryptographic data path (UR/PSBT/wallet descriptors/BIP39 seeds)New native C module is not visible in this diff; behavior must be trusted to MaixPy firmware imageShim layer changes string case handling (uppercase Bytewords) and decoder attribute semantics
401c70c4by odudex+167−7612 files
No security note in commit
Open full analysis →Source commit ↗
High 74 AI analysisMessage 83 · Strong
KX KruxKrux BitcoinHardware wallets

Security Hardening (#851)

This commit fixes four security weaknesses in Krux, a Bitcoin hardware-wallet project. The changes prevent: (1) encrypted backups from declaring zero or very low password-stretching effort, which would make them easy to brute-force; (2) mu…

Minimum PBKDF2 iteration enforcement against trivial work-factor envelopesRejection of multiple origin-less xpubs in multi-key descriptorsSD file-list filtering of traversal entries ('.', '..', path separators)
8f62c860by Odudex+263−39 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 93 · Strong
KX KruxKrux BitcoinHardware wallets

fix: warn user before signing raw hashes in message signing (#846)

This commit adds a warning screen to Krux's message-signing feature when the user is about to sign a raw 32-byte hash or a 64-character hex string. Previously, the device would silently treat such inputs as already-hashed values and sign t…

Silent signing of raw 32-byte values allowed transaction sighash spoofingMessage signing path treated raw hashes identically to SHA256(message) digestsFix explicitly references 'C3 of #843' as a security concern
23bc73b3by Odudex+46−726 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 98 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject PSBT inputs with non-standard sighash types before signing (#844)

Krux is a small, open-source Bitcoin signing device (hardware wallet). This commit fixes a security flaw where the device would sign transactions even if the sender asked it to use unusual Bitcoin signature modes—specifically SIGHASH_NONE,…

Explicit security fix for externally-reported audit finding (#843 C2)Pre-sign validation added to reject non-standard sighash typesRelevant to transaction-replacement / fund-redirect attacks via SIGHASH_NONE/SINGLE/ANYONECANPAY
e5318112by Odudex+115−03 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 98 · Strong
KX KruxKrux BitcoinHardware wallets

chore: require urllib3 >2.6 security fix for CVE-2025-66471 urllib3 is dependency of requests and translate, used in dev tools

This commit updates the project's Python dependency lock file to require urllib3 version 2.6.0 or newer. The commit message says this is a security fix for CVE-2025-66471, a vulnerability in the urllib3 library. urllib3 is used indirectly …

Dependency version bump for a reported CVE (CVE-2025-66471)urllib3 constrained to >=2.6.0Affected packages moved from main to dev dependency group, limiting runtime exposure
268f3f7bby odudex+23−172 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 58 · Thin
KX KruxKrux BitcoinHardware wallets

Datum crypto-bip39: join list so Datum can load and display it (#799)

This commit fixes a display bug in Krux's Datum tool. When a user scanned a BIP39 mnemonic seed phrase from a QR code, the device received the words as a list but tried to show them as a single string, which could not render correctly. The…

No security-relevant keywords in commit title or messageNo input validation changesNo cryptographic operation changes
9a06ae7fby Odudex+2−42 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 58 · Thin
KX KruxKrux BitcoinHardware wallets

Embit update: Improved BIP39 mnemonic validation (#759)

This commit tightens how a Bitcoin wallet tool (Krux) checks recovery phrases. Previously, the code accepted phrases with extra spaces, tabs, newlines, or commas between words because it used a loose 'strip and split' approach. Now it requ…

Stricter input validation for BIP39 mnemonic parsingRejection of whitespace-normalized parsing that could mask malformed user inputAlignment with upstream embit validation behavior
6806a792by Odudex+43−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 74 · Adequate
KX KruxKrux BitcoinHardware wallets

Release 25.10.1 (#757)

This release fixes a bug in Krux, a Bitcoin signing device firmware. When a user scanned an encrypted QR code meant to provide a wallet passphrase, address, or wallet descriptor, the device could silently treat the raw encrypted bytes as t…

Silent derivation of wrong wallet from encrypted passphrase/data due to uncaught decoding exceptionCross-runtime behavior difference: CPython UnicodeDecodeError vs MaixPy TypeErrorMissing input validation for passphrase character set
64212093by Odudex+259−610 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
KX KruxKrux BitcoinHardware wallets

Merge pull request #711 from selfcustody/release-25.09.0

This commit is a routine release merge (Release 25.09.0) that adds the entire Krux project repository as a new import. The diff shows only new files: documentation, images, build tooling, CI workflows, configuration, and source code. There…

8e4a2cfbby Odudex+3144733−0771 files
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →