Blockstream Jade

This commit is a code cleanup: it pulls the logic for waiting on a button press into a single shared helper function so the same code isn't repeated in many places. The behavior is essentially unchanged. The only functional difference is that one screen (the mnemonic setup) now explicitly treats a timeout as an error in normal builds, whereas before it would have hit a generic assertion. This is a minor hardening improvement, not a security vulnerability.

This commit reverts a previous change that made the Jade Plus (ESP32-S3) camera use a higher VGA resolution. It returns all hardware variants to the lower QVGA resolution because QVGA was found to scan QR codes faster and more accurately on Jade Plus. It also removes the larger VGA test images and simplifies the output-message buffer size logic. There is no security fix or vulnerability here.

This commit fixes a bug in how Blockstream Jade signs Liquid Bitcoin transactions. When extra data ('additional_info') was provided for a transaction input, the hardware wallet was not updating its internal running totals of input amounts per asset. This could cause the device to miscalculate whether a transaction is balanced—potentially allowing a malicious or buggy host to trick the wallet into approving a transaction that silently moves more value than the user expects. The fix makes the wallet explicitly require and record the input's asset and amount in this code path.

This change only affects the project's test script. It deletes leftover test PIN files before running tests so developers don't get confused by stale data from earlier runs. There is no security issue in the product itself.

This commit blocks PSET (a privacy-enhanced Bitcoin transaction format) parsing on Blockstream Jade hardware wallets that lack extra RAM (SPIRAM). The change prevents the device from running out of memory while handling complex PSET data. It is a hardening/defensive fix rather than a clear exploit patch, because the commit message and diff do not describe an actual vulnerability—only a known resource limitation.

This commit only adds new test cases for signing Liquid multisig transactions on the Blockstream Jade hardware wallet. It introduces two JSON test fixtures and a one-line change to include them in the test suite. There is no change to production code, no bug fix, and no security-relevant behavior.

This commit only changes test code. It makes the test helper pass an optional 'additional_info' field through to the sign_psbt() function when it is present in test cases. There is no change to the actual signing code or wallet behavior, so it does not create or fix a security vulnerability.

This commit updates the Python library that talks to the Blockstream Jade hardware wallet. It lets callers pass an optional extra data dictionary called additional_info when signing a Bitcoin PSBT, matching a feature already available for Liquid transactions. The change itself just forwards the new parameter to the device; it does not appear to fix or introduce a vulnerability on its own.

This commit adds Liquid swap signing support for PSBTs in the Blockstream Jade hardware wallet firmware. It also restructures cleanup paths so memory is freed correctly when validation fails. The change is a feature addition with defensive cleanup improvements, not a clear-cut security fix, but it touches code that protects user funds during transaction signing.

This commit fixes how Blockstream Jade signs Liquid (Elements) Taproot transactions. Previously, the device used Bitcoin-style signature hashing for all networks, which is incorrect for Liquid Taproot. The fix passes a special 'Elements' flag when signing on Liquid so the signature hash matches Liquid's rules. Without this, signatures produced for Liquid Taproot transactions would be invalid or could potentially be produced using the wrong cryptographic formula, which in hardware wallets can sometimes lead to security issues like key leakage or signature-forgery attacks.

This commit blocks a specific kind of Bitcoin/Liquid transaction signing on the Blockstream Jade hardware wallet. It prevents 'swap' transactions from using 'taproot' inputs because the device's signature-calculation code does not yet safely handle that combination. Without the fix, a user might have been able to build a transaction that the wallet would sign incorrectly or in a way that could be exploited, potentially leading to loss or theft of funds in a swap.

This commit adds checks for the Liquid network's 'genesis blockhash' in a Bitcoin hardware wallet signing flow. It ensures the PSBT (Partially Signed Bitcoin Transaction) includes the correct network identifier before signing, and fills it in if missing. Without this, a specially crafted transaction could potentially trick the device into signing for the wrong Liquid network or into producing invalid Taproot signatures. The change is defensive and aligns with the ELIP-0101 specification.

This commit is a code cleanup in the transaction signing logic for Blockstream Jade hardware wallets. It splits one function into two: one that gathers output information and another that validates it. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a refactoring to make the code clearer and to allow future reuse in PSBT signing.

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) tracks which transaction inputs it needs to sign. Previously it stored a simple yes/no flag; now it stores the actual signature type requested by the PSBT (Partially Signed Bitcoin Transaction). The change is mostly a code-quality improvement, but it removes a place where the wrong signature type could silently be assumed. There is no direct evidence in the commit that an actual vulnerability was fixed, and no vendor security disclosure is present.

This commit is a pure code-style refactor. It flips a large 'if' block into an early 'continue' so the code inside is no longer deeply indented. The commit message explicitly says there are 'No functional changes'. No security issue is introduced or fixed.

This commit adds a safety check in the code that signs Bitcoin transactions. It ensures that when the wallet decides to produce a Taproot-style signature, the script being spent actually looks like a Taproot script, and vice versa. Without this check, a mismatch between the script type and signature type could potentially lead to incorrect signatures or unexpected behavior when signing transactions.

This commit is a code cleanup that moves the rules for which Bitcoin/Liquid 'sighash' flags are allowed into one shared helper function used by both signing paths. Before, the PSBT signing path only rejected non-ALL sighashes for non-Taproot inputs, while the direct sign_tx path had more detailed rules (for example, allowing SINGLE|ANYONECANPAY for partial Liquid swaps). Unifying the logic reduces the chance that one path accidentally allows a dangerous sighash. The change itself does not add new user-facing behavior; it is defensive hardening/refactoring.

This commit reorganizes how Blockstream Jade validates transaction data before signing. It moves several Liquid-network checks earlier in the process and adds new rules: a transaction output with no recipient script (typically a network fee) must now be unblinded, non-zero, use the network's official policy asset, and there can only be one such fee output. The change also prevents a transaction from being silently treated as a different network type (Bitcoin vs. Liquid). These are defensive hardening measures rather than a fix for a confirmed active attack.

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) obtains the transaction it signs from a Partially Signed Bitcoin Transaction (PSBT). For older v0 PSBTs, it now uses the transaction embedded in the PSBT directly instead of extracting a fresh copy. The main risk is that the code now trusts the PSBT's internal transaction more directly, but the commit also adds a safety check that the transaction exists and matches the PSBT's input/output counts. There is no clear security bug visible in the diff, but the change touches sensitive signing logic and is described only as a simplification, not a security fix.

This commit refactors how the Blockstream Jade hardware wallet checks transaction fees when signing a PSBT. Previously, the fee was calculated and validated inside the PSBT-specific code. Now it uses a shared validation routine that is also used for regular transaction signing. The goal is consistency: the same duplicate-fee and fee-validation checks apply regardless of whether the user is signing a raw transaction or a PSBT. The commit removes several local fee checks (such as rejecting blinded fee outputs or unexpected fee asset IDs) and relies on the shared function instead. This is a code-quality and consistency improvement, not a clear-cut security fix, but it touches security-critical fee logic.

This commit simply renames a local variable from `liquid_fees` to `explicit_fee` inside the transaction-signing code. The change is purely cosmetic and does not alter any logic, calculations, or security behavior. It is described by the author as making the code consistent with PSBT signing code elsewhere.

This commit is a straightforward code cleanup: it moves type and function declarations that were scattered across several files into a single new header file called sign_utils.h. There is no change to what the code actually does, only to how the source files are organized. It does not fix or introduce any security issue.

This commit is a simple code cleanup: it renames several internal helper functions from names starting with 'rpc_get_' to names starting with 'params_' so they match the naming style used elsewhere in the project. It also makes two helpers 'static' (private to their file) and fixes a typo in a comment. There is no change to behavior, no bug fix, and no security impact.

This commit changes the Blockstream Jade hardware wallet firmware so it can now sign Liquid/Elements PSET transactions instead of rejecting them. It also adds a check that the PSBT type matches the selected network (Bitcoin vs. Liquid). A new FIXME comment asks whether Bitcoin signing should only accept 'non-witness utxo' data, and descriptor-based wallet signing is disabled for Elements. The change is a feature addition with some defensive tightening, not a clear vulnerability fix, but it touches security-critical signing code.

This commit enables the Jade hardware wallet to sign Liquid network transactions using the existing sign_psbt command. Previously, this command was rejected for Liquid. The change mainly removes that rejection, skips Bitcoin-only fee math on Liquid, and updates test fixtures. It is a feature-enablement patch rather than a clear security fix, and the commit message says full tests will follow later.