BitBox02 firmware

This commit fixes a fee-warning gap in the BitBox02 Bitcoin signing flow. Previously, transactions that only sent money back to yourself (change outputs) or only carried an OP_RETURN message had no 'send amount' to compare the fee against, so the device would not warn even if the fee was huge. The patch now compares the fee to the total value of all transaction inputs in those cases, and still warns the user when the fee exceeds 10% of that total. It also updates the on-screen wording to say whether the percentage is relative to the send amount or to all inputs.

This commit changes how the BitBox02 hardware wallet shows large transaction and swap amounts on its small screen. Previously, long amounts were silently cut off with '...', which could hide the true value from the user. Now the device either shrinks the font or shows the full amount on a scrollable screen. The change also adds checks to reject absurdly long externally supplied swap amount strings. The main security benefit is that users can now verify the complete amount they are approving, reducing the chance of being tricked by a truncated value.

This update fixes a bug in how the BitBox02 hardware wallet reads backup files from an SD card. A tampered backup file could claim to contain a seed longer than the 32-byte limit, which previously caused the device to panic (crash) when listing backups. The fix rejects such malformed files, and a new test confirms the behavior.

This commit fixes a UI cleanup bug in the BitBox02 hardware wallet's U2F (Universal 2nd Factor) feature. Previously, a 'Refresh webpage' screen could be destroyed without clearing the pointer that tracked it, potentially leaving a dangling reference. The patch adds a custom cleanup handler that nulls out the pointer when the screen is removed. There is no direct evidence in the commit of a security exploit, but use-after-free or dangling-pointer bugs in firmware can sometimes have security implications if they lead to crashes or memory corruption.

This commit fixes how a small on-screen reminder (the 'nudge screen') for U2F is created, tracked, and cleaned up. Before the fix, the code could lose track of the reminder screen or mishandle its removal, which might cause display glitches or memory issues. The patch makes cleanup more reliable by tying the global pointer to the screen's actual destruction.

This commit adds a hard limit on how deeply nested Ethereum typed-message (EIP-712) structures can be when the BitBox02 hardware wallet signs them. Without the limit, an attacker could craft a message type that refers to itself over and over, causing the firmware to recurse until it runs out of stack memory and crashes. The patch caps recursion at 16 levels, validates the whole type tree before any user interaction or host callbacks, and adds tests for the boundary.

This commit replaces an unbounded task queue inside the BitBox02 firmware's Rust executor with a fixed 16-slot ring buffer. It also adds a hard limit of 16 active tasks and protects queue access with critical sections so interrupt-driven code and the main loop don't corrupt the queue. The change removes a third-party queue dependency and adds unit tests. It is a defensive hardening patch: it prevents memory exhaustion from an ever-growing queue and removes allocation from interrupt paths, but it does not by itself fix a known exploitable bug.

This commit adds a warning screen to the BitBox02 hardware wallet whenever a long message or value is about to be shown in a truncated form. Previously, the device could silently cut off the end of very long transaction details, message data, or policy names, potentially hiding important information from the user before they approve an action. The fix shows a 'Warning: the next value is too large to display in full' screen first, so users know they are not seeing the complete content.

This firmware update relaxes the rules for valid Ethereum typed-data (EIP-712) names so they can contain a colon (:), which some decentralized apps use as a namespace separator. Member names still cannot contain colons. The change is presented as safe because a colon cannot be confused with the punctuation that separates type names, fields, and arrays in EIP-712 encoding.

This commit adds a new Python client feature called BitBoxSync to the BitBox02 Python library. It introduces generated protobuf code, new API methods to request identity keys, sign various sync-related intents, and unwrap an encrypted namespace key, plus a demo menu in the developer test tool send_message.py. There is no indication in the commit that this fixes a security bug; it appears to be a normal feature addition.

This commit adds a new Rust build helper crate for the STM32U5A9J-DK development board. It compiles a single C file from STMicroelectronics' HAL library into an object file and links it into firmware builds so a custom board initialization function overrides the weak default. There is no indication of a security vulnerability or fix.

This commit adds a new Rust helper library and a Python script for creating and validating firmware image headers for the BitBox02/BitBox03 bootloader. It is purely an infrastructure/feature addition: it defines data structures, parsing routines, boot argument handling, and image-header tooling. There is no bug fix, no patch of an existing vulnerability, and no indication this change itself introduces a security flaw.

This commit adds a new internal debugging library called bitbox-debug and vendors several Rust dependencies (once_cell, portable-atomic, rtt-target). There is no indication in the commit message or diff that this fixes a security vulnerability. It appears to be a feature/infrastructure addition for firmware debugging.

This commit simply adds the official STMicroelectronics (ST) driver library for the STM32U5 microcontroller family into the project's source tree. It is a large import of vendor-provided header files, source files, and license files. There is no bug fix, no functional change to the wallet application, and no indication of a security issue being addressed.

This commit adds a visual progress bar that appears on the BitBox02 screen while the device is receiving large Ethereum transaction data or typed-message data from the host computer. It is purely a user-experience change: it shows 'Loading data...' with a progress fraction during streaming, and updates the test mock UI so automated tests can verify the progress values. There is no security-relevant change to cryptography, parsing, bounds checking, or host/device trust boundaries.

This commit adds a new first-stage bootloader component called bitbox03-boot1 for the BitBox03 hardware wallet. It is purely additive: it wires a new Rust binary into the build system, adds a flashing script, and provides a small program that validates a firmware image header and then jumps to the main firmware. Nothing in the commit changes existing security behavior or fixes a known vulnerability.

This commit adds a new first-stage bootloader component called bitbox03-boot0 for an upcoming BitBox03 hardware wallet. It is purely additive development code: it introduces build targets, a linker script, flashing scripts, and a small Rust program that validates and then launches the next-stage bootloader (boot1). There is no indication of a bug fix or security patch, and no disclosed vulnerability.

This commit simply deletes an unused third-party Rust crate (cmake) from the project's vendored dependencies. It is a cleanup change with no functional code modifications and no apparent security relevance.

This commit changes how a graphics library (LVGL) is compiled into the BitBox02 firmware build. It removes the CMake-based build and instead compiles the library's C source files directly using Rust's cc crate. It also merges a separate simulator-specific configuration file into a shared one. The visible configuration changes are: color depth increased from 16 to 32 bits, refresh period shortened from 33 ms to 17 ms, and log level changed from warnings to informational messages. These are build-system and configuration cleanups; there is no direct evidence in the commit of a security vulnerability being fixed.

This commit is a small optimization in the BitBox02 hardware wallet firmware. It changes how many times the device derives a cryptocurrency address when validating a payment request. Previously, addresses were derived twice (a safety check called 'compute twice'); now they are derived once during payment-request validation, while other operations still derive them twice. This is a performance/counter fix, not a security vulnerability fix. There is no evidence in the commit that it addresses an exploitable bug.

This commit is a straightforward internal code cleanup. It merges two similar functions for computing extended public keys (xpubs) into one function that accepts a mode flag, and moves the mode definition to a more central location. There is no change to security behavior: operations that previously computed xpubs twice still do so, and operations that computed them once still do so. It is a refactoring, not a security fix.

This patch fixes a timing bug in how the BitBox02 hardware wallet talks to its secure chip (Optiga). Previously, the code could overwrite memory buffers that were still being used by an unfinished, dropped secure-chip operation. That could corrupt data or cause the device to behave unpredictably when secure-chip commands were started and then abandoned. The fix simply makes sure the code checks for and reclaims any leftover detached operation before touching the shared buffers.

This commit flips a build-time option in the blake2 Rust library from 'fast and large' to 'smaller and less inlined.' It is a pure code-size optimization that does not change the hashing algorithm, inputs, outputs, or how the firmware calls it. There is no security-relevant change visible in the diff.

This commit tightens Rust type signatures for functions that talk to the secure chip (Optiga). Instead of accepting arbitrary-length byte slices and then checking lengths at runtime, the functions now require fixed-size arrays. This is a defensive hardening change: it moves some length checks from runtime to compile time, reducing the chance of a length mismatch bug being exploited. There is no direct evidence in the commit that an exploitable vulnerability existed before this change.

This commit only bumps the firmware version number from v9.26.0 to v9.26.1 and adds a one-line changelog entry saying 'Fix a payment request validation issue.' The actual code fix is not present in this commit, so we cannot directly assess what the bug was, how severe it is, or how it could be exploited. The changelog wording suggests a security or correctness issue in how payment requests are checked before being approved on the BitBox02 hardware wallet, which could in principle trick a user into authorizing an unintended payment. However, without the patch that fixes the issue, this is mostly speculation.