Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.
This commit is a routine build-system and code-formatting fix. It resets cached CMake build options so each build starts from known defaults, makes cbindgen header-generation failures visible instead of silently ignored, runs Rust formatti…
This commit adds a hard cap on how many files the device will list from its SD card when loading multi-signature Bitcoin wallet data. It also tightens up null-pointer and length checks while scanning directories. The likely goal is to prev…
Unbounded directory listing now bounded by FATFS_MAX_FILE_NUMBERNull-pointer guards added for fileName, number, and path parametersLength checks added before copying filenames into caller buffers
This commit updates the hardware random number generator (TRNG) driver in a cryptocurrency hardware wallet firmware. It adds detection for a physical tamper/attack signal from the TRNG chip and, if an attack is detected, wipes the random d…
New check of TRNG_IT_RNG0_ATTACK tamper/attack interrupt statusFailure path now zeroes output and local buffer before abortingAddition of ASSERT guards and secure memset_s usage
This commit swaps out the LVGL graphics library's pseudo-random number generator for the device's hardware true random number generator (TRNG) in two places: shuffling the on-screen numeric keypad and shuffling recovery-word lists. The old…
Replacement of non-cryptographic PRNG with hardware TRNG in security-sensitive shuffle routinesFisher-Yates shuffle of on-screen PIN keypad now uses TrngGetFisher-Yates shuffle of mnemonic word array now uses TrngGet
This commit only deletes a planning document from the repository's docs folder. No firmware code, build scripts, or cryptographic logic were changed. The deleted file described a previously completed security-hardening task about removing …
Deleted document references a prior security-hardening task (issue #2255 / PRNG fallback removal)No source-code or build-system changes in the diff
This commit removes a weak, predictable random-number generator that was bundled as a backup inside the firmware's SLIP-39 code. Previously, if the device's proper hardware random source was accidentally left out of a build, the firmware c…
Removal of deterministic LCG PRNG (random32)Removal of weak-symbol random_buffer fallbackRemoval of unused random helper APIs
This commit refactors how a Solana cryptocurrency derivation path is stored while parsing a USB request. Previously, the code dynamically allocated a small heap buffer inside a helper function and returned it to the caller, which then had …
Eliminates heap allocation for a fixed-size derivation-path bufferRemoves manual free responsibility from caller, reducing memory leak / use-after-free riskSwitches helper return type from pointer to bool to enforce explicit success/failure handling
This commit adds Solana CLI support to the Keystone 3 hardware wallet firmware. It introduces a new USB command that lets a connected computer request public keys for specific Solana derivation paths, and it reworks how USB responses are s…
New USB command exposes public-key export for a specific coin type and derivation pathAdded NULL/empty checks before returning generated UR data and before using cached passwordMoved several UR result sends from synchronous to asynchronous (task-queue based) dispatch
This is a one-line build fix that changes a padding length constant from 1 to 2 in a file used only for Bitcoin-only firmware builds. There is no indication in the commit of any security issue, vulnerability, or functional bug. It appears …
This commit is a routine localization and asset update. It adds a Polish language translation, updates Korean font data to include one additional character, fixes minor code indentation, and reorders some translated strings. There is no ev…
This commit fixes several bugs in the firmware of the Keystone 3 hardware wallet, mainly around how Arweave (AR) cryptocurrency keys and RSA prime numbers are handled. It replaces direct array indexing with safer lookups, adds checks for m…
Out-of-bounds index fix: ChainType enum no longer used directly as array index for g_chainTable/g_accountPublicInfoSensitive-data cleanup: RSA prime flash region and SE hash are erased when an account is deletedTamper-response expansion: anti_tamper erase loop now covers the new RSA primes hash page
This commit removes support for the 'Leap' wallet from the Keystone 3 firmware. It deletes the Leap wallet icon and asset, removes Leap-related text strings from Chinese, Japanese, and Korean font files, and updates the Rust dependency ver…
This firmware update fixes two categories of bugs in a cryptocurrency hardware wallet's background task system and web-authentication code display. First, it adds a flag so the background task knows whether it allocated a memory buffer its…
Memory ownership flag added to async task structure to prevent freeing caller-owned buffersMissing null check after SRAM_MALLOC for RSA key buffer is now presentPrivate RSA key material is explicitly cleared with memset_s before deallocation
This commit is a straightforward build fix for a firmware configuration file. It adds conditional preprocessor definitions so that different product build variants (Web3, BTC-only, Cypherpunk) each define a required constant, LEGACY_USB_PA…
This is a one-line build fix that changes a default padding length constant from 1 to 2 in a legacy USB web-update feature. There is no indication of a security problem, and the change itself does not introduce or fix any vulnerability vis…
This commit fixes a simple UI bug in the Avalanche (AVAX) transaction review screen. The code was accidentally passing the recipient's address length where the sender's address length should go, which could cause the sender's address to be…
UI display parameter mismatch in transaction review screenPotential sender address truncation or misrenderingNo change to signing, parsing, or cryptographic code
This commit fixes how Keystone 3 hardware wallets parse Avalanche (AVAX) transactions. Previously, the code only handled a single derivation path and a single sender address. The update supports multiple input addresses/paths, correctly ma…
UI display of transaction senders changed from single address to multiple addressesDerivation path matching logic changed from single-path to multi-path iterationMemory deallocation for 'from' vector re-enabled after struct type change
This commit is a routine regeneration of font glyph data for the device's user interface. It removes a few unused Chinese characters from the symbol lists and updates the corresponding bitmap tables and translation data. There is no indica…
This is a one-line type-name correction in the Avalanche (AVAX) transaction display code. The developer changed a variable declaration from a TON (Telegram Open Network) transaction result type to the correct AVAX transaction result type. …
Type-name mismatch between TON and AVAX transaction result typesNo change to arguments, control flow, or memory handlingLikely identical C struct/typedef layout, so runtime behavior unchanged
This commit fixes a firmware crash that could occur when a wallet created with only a TON (The Open Network) mnemonic was upgraded to the 'cypherpunk' firmware version. The crash happened because two code paths that handle public key/accou…
Denial-of-service condition: device crash during firmware update for a specific wallet typeLogic flaw: missing mnemonic-type guard for TON-only wallets in account setup pathsPreprocessor conditional (WEB3_VERSION) incorrectly excluded TON guard in some builds