CommitWatch RSS
BS
← All projectsBlockstream

Blockstream Jade

Firmware for Jade and Jade Plus Bitcoin hardware wallets.

BitcoinHardware walletsElevated watch
Source repository ↗
Repository coverage

502 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

106security candidates69second-pass queue437AI analyses
25commits · 30 days
67commits · 60 days
220commits · 180 days
417commits · 365 days
Backfill bands
Aug 5 → Feb 6216 seen38 candidatesComplete
Feb 6 → Jun 6131 seen9 candidatesComplete
Jun 6 → Jul 657 seen10 candidatesComplete
Jul 6 → Aug 510 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

57/100 average clarity
32Strong · 80–100
182Adequate · 60–79
250Thin · 40–59
38Opaque · 0–39
5security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Jon Griffiths31357282157
Mike Tolkachev431438152
Daniel Newton771668055
Mihailo Milenkovic878057
roderico333060
Valerio Vaccaro1526054
Jamie C. Driver525053
Gustavo Cateim917078
Austin-Fulbright414060
quantpoet111072
cmiguelrn111045
tokyovyse111063
Analysis record

Published AI watches

Last scanned 50 minutes ago

Informational 20 AI analysisMessage 65 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

fmt: fix and prevent future use of unsupported format spec "zu"

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage val…

Use of unsupported printf format specifier %zu on embedded targetPotential for malformed log/UI output due to undefined format behaviorAddition of CI guard to prevent recurrence
26042182by Jon Griffiths+21−145 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 30 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

otp: release md context on failure and clean temporary buffers

This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data w…

Resource leak fix: mbedtls_md_free() now called on prepare_md_ctx failure pathSensitive buffer zeroization: wally_bzero() added for rcnt_buf and hmacControl-flow change from macro-based early return to explicit success checks
6e2cb6b6by Mike Tolkachev+26−141 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 25 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

identity: clean temporary hash buffer

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensiti…

Sensitive memory not marked for clearing (missing SENSITIVE_PUSH/POP)Buffer holds HMAC-SHA512 output used in BIP32 hardened child key derivationPatch adds explicit sensitive-memory lifecycle management
b5c35779by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 15 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qrmode: clean temporary buffer

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for la…

Sensitive temporary buffer not cleared before fixUse of SENSITIVE_PUSH/SENSITIVE_POP memory-clearing macrosQR payload data may include private or confidential material
34f68c20by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

pinserver: retain unit private key on url change

This commit changes how Blockstream Jade handles its PIN server settings. Previously, changing the PIN server web address (URL) also wiped the device's private PIN encryption key, forcing the device to create a fresh one. The patch keeps t…

PIN private key lifecycle change: key retained on URL-only pinserver updatePublic-key change still triggers private-key erasure/regenerationDebug-clean and full reset still erase private key
ddcd93a3by Mike Tolkachev+38−324 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

add more boards and descriptions

This commit is a documentation update for the do-it-yourself (DIY) hardware section of the Blockstream Jade project. It adds descriptions and photos for additional supported circuit boards and updates image file references. There are no co…

f4fb150dby Valerio Vaccaro+65−1625 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

process: limit array sizes in sign_tx, register_multisig and sign_bip85_digests

This commit adds size limits to several message-handling functions in the Blockstream Jade hardware wallet firmware. It caps how many asset records, transaction inputs/outputs, multisig signers, and BIP85 RSA digests a single RPC message c…

Adds explicit upper bounds on attacker-controllable array sizesRejects zero-input/zero-output transactions before further processingMoves BIP85 digest count validation before memory allocation
e87f26bfby Daniel Newton+251−8114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

Update CHANGELOG.md

This commit only updates the project's CHANGELOG.md file to add release notes for version 1.0.41. It does not change any source code, build scripts, or configuration. The changelog text itself states that version 1.0.41 contains important …

Changelog describes prior security fixes in release 1.0.41Mentions external security researchers and tools (Loupe, Kvazar)References security-relevant improvements: stack protection, entropy, secure version, memory scrubbing, thread safety
dd45a7dcby Jon Griffiths+49−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

jadepy: update jadepy release

This commit simply bumps the version of a Python dependency called jade-client from 1.0.40 to 1.0.41, along with its matching cryptographic hashes and a fresh PGP signature. There is no code change visible here, and nothing in the commit m…

75eeada4by Jon Griffiths+19−192 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

consistency: fix docs/comment/script typos

This commit fixes five spelling mistakes in documentation, code comments, and a script comment. None of the changes alter program behavior or affect security.

9ea7eed3by Jon Griffiths+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

esp_lcd: vendor the esp_lcd component (ESP-IDF v5.5.4)

This commit copies the ESP-IDF 'esp_lcd' display-driver component directly into the Blockstream Jade firmware repository (a process called 'vendoring') at version 5.5.4. It adds about 8,700 lines of display-interface code for LCD panels us…

Large vendored third-party driver import (+8,718 lines, 43 files)Driver code runs in interrupt context and uses DMA, which historically carries memory-safety and cache-coherency risksNo explicit security fix or bug-fix narrative in commit title/message
d89207bfby Daniel Newton+8718−043 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 57 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: "fakeprod" prod-like development mode

This commit adds an official developer-only 'fakeprod' build mode for Blockstream Jade hardware wallets. It deliberately weakens several security settings (single signature, committed private keys, readable flash-encryption key, enabled JT…

In-tree private keys committed to repository (tools/fakeprod_v2.pem, tools/fakeprod_attest.pem)Secure boot minimum signatures reduced from 2 to 1Flash encryption set to DEVELOPMENT mode with key readable
cecedc76by Daniel Newton+350−59 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

urldecode: add validation for URL encoding

This commit hardens a URL-decoding helper in Blockstream Jade's firmware. It adds validation so malformed percent-encoding, embedded null bytes, control characters, and non-ASCII bytes are rejected instead of being silently decoded. A new …

Input validation added for percent-encoded sequencesRejection of embedded NUL bytes and control characters in decoded outputRejection of non-ASCII decoded bytes (>=0x80 and DEL 0x7f)
dd0d699dby Mike Tolkachev+100−272 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 73 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qr: split datastream data into its own allocation, reorder alloc/free calls

This change rewrites how a small QR-code scanning library allocates memory. Instead of one big 16 KB block, it now uses two separate 8 KB blocks, and it frees them in the reverse order they were allocated. The stated goal is to avoid memor…

Memory allocation pattern changed from single large allocation to two smaller allocationsAllocation/free ordering changed to LIFO-style reverse pairingPointer field added to struct that previously held an inline array
43640f8cby Jon Griffiths+24−153 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: check output amount presence before reading

This commit tightens how Blockstream Jade reads output amounts from a Partially Signed Bitcoin Transaction (PSBT). Before, the code tried to read the amount directly without first confirming it was actually present. Now it checks whether t…

Missing-field check added before sensitive value readPSBT output amount parsing hardenedDefensive validation of libwally presence flags
9f2b916dby Jon Griffiths+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: require that all psbt bytes are consumed when parsing

This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes…

Parsing now rejects trailing/unconsumed bytes in PSBT inputChange is in the signing code path, directly affecting what the hardware wallet will signUse of stricter libwally-core parse flag (COMPLETE) indicates parser hardening
605d86acby Jon Griffiths+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

hardware: add Jade Plus design files

This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device …

5ad85661by bitcoinhelp+2573−122520 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tests: migrate low level tests

This commit only moves and reorganizes existing test code. It adds a new helper to check whether the current transport is a specific type, moves a shared wait() function into a common test package file, and migrates a large set of low-leve…

767006a0by Valerio Vaccaro+1580−54 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

mnemonic: restore recovery phrase by word number

This commit adds a new way to restore a Bitcoin wallet on a Blockstream Jade hardware device: instead of typing each recovery word, users can enter each word's one-based BIP39 number (for example, '1' for 'abandon'). The change also refact…

New user-input path for seed recovery (word numbers instead of words)Refactoring of mnemonic input/validation helpersAddition of SENSITIVE_PUSH/POP for local mnemonic buffers
99927491by roderico+580−3183 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

ui: support bounded variable-length digit entry

This commit refactors the on-screen digit-entry keypad in Blockstream Jade so callers can ask for shorter number fields (for example 4 digits instead of 6) and optionally cap the entered value. The existing 6-digit PIN and index entry beha…

New bounded numeric input path may prevent out-of-range values in future callersRefactoring centralizes input validation rather than relying on callersNo buffer-size changes observed; digit array remains DIGIT_ENTRY_SIZE (6) elements
69627745by roderico+128−332 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatesign_tx: rename signing cbor getters to match the other params() callsby Jon Griffiths · 25b1dd6a · Sep 4, 2025 · 3 filesMessage 50 · ThinInformational 15Details
Commit message · Jon Griffiths

sign_tx: rename signing cbor getters to match the other params() calls

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit is a simple code cleanup: it renames several internal helper functions from names starting with 'rpc_get_' to names starting with 'params_' so they match the naming style used elsewhere in the project. It also makes two helpers 'static' (private to their file) and fixes a typo in a comment. There is no change to behavior, no bug fix, and no security impact.

Security candidatesign_tx: split out signing tx validation, add more checksby Jon Griffiths · 1705ca93 · Sep 4, 2025 · 3 filesMessage 65 · AdequateModerate 57Details
Commit message · Jon Griffiths

sign_tx: split out signing tx validation, add more checks

Also move the explicit fee fetching/validation into the split out
function.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Moderate 57/100

This commit reorganizes how Blockstream Jade validates transaction data before signing. It moves several Liquid-network checks earlier in the process and adds new rules: a transaction output with no recipient script (typically a network fee) must now be unblinded, non-zero, use the network's official policy asset, and there can only be one such fee output. The change also prevents a transaction from being silently treated as a different network type (Bitcoin vs. Liquid). These are defensive hardening measures rather than a fix for a confirmed active attack.

Security candidatesign_tx: use explicit_fee for consistency with psbt signingby Jon Griffiths · 20cde04a · Sep 4, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Jon Griffiths

sign_tx: use explicit_fee for consistency with psbt signing

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit simply renames a local variable from `liquid_fees` to `explicit_fee` inside the transaction-signing code. The change is purely cosmetic and does not alter any logic, calculations, or security behavior. It is described by the author as making the code consistent with PSBT signing code elsewhere.

Security candidatesign_psbt: use the psbt tx directly if possibleby Jon Griffiths · 90f16a56 · Sep 4, 2025 · 1 fileMessage 60 · AdequateInformational 24Details
Commit message · Jon Griffiths

sign_psbt: use the psbt tx directly if possible

Since we aren't finalizing the tx, we can use it directly for v0 PSBTs
and avoid creating a new one.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 24/100

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) obtains the transaction it signs from a Partially Signed Bitcoin Transaction (PSBT). For older v0 PSBTs, it now uses the transaction embedded in the PSBT directly instead of extracting a fresh copy. The main risk is that the code now trusts the PSBT's internal transaction more directly, but the commit also adds a safety check that the transaction exists and matches the PSBT's input/output counts. There is no clear security bug visible in the diff, but the change touches sensitive signing logic and is described only as a simplification, not a security fix.

Security candidatepset: allow sign_psbt to be called for liquidby Jamie C. Driver · 3ab9dcd2 · Sep 4, 2025 · 4 filesMessage 70 · AdequateLow 35Details
Commit message · Jamie C. Driver

pset: allow sign_psbt to be called for liquid

This initial commit just enables support with tests coming later.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 35/100

This commit enables the Jade hardware wallet to sign Liquid network transactions using the existing sign_psbt command. Previously, this command was rejected for Liquid. The change mainly removes that rejection, skips Bitcoin-only fee math on Liquid, and updates test fixtures. It is a feature-enablement patch rather than a clear security fix, and the commit message says full tests will follow later.

Security candidatepset: handle signing psetby Jamie C. Driver · c4cc4a09 · Sep 4, 2025 · 1 fileMessage 35 · OpaqueLow 40Details
Commit message · Jamie C. Driver

pset: handle signing pset

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 40/100

This commit changes the Blockstream Jade hardware wallet firmware so it can now sign Liquid/Elements PSET transactions instead of rejecting them. It also adds a check that the PSBT type matches the selected network (Bitcoin vs. Liquid). A new FIXME comment asks whether Bitcoin signing should only accept 'non-witness utxo' data, and descriptor-based wallet signing is disabled for Elements. The change is a feature addition with some defensive tightening, not a clear vulnerability fix, but it touches security-critical signing code.