Passport firmware

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, regardless of how long each word is. The stated goal is to make the copy operation take the same amount of time and perform the same memory accesses for every word length, which can help defend against timing and power-analysis side-channel attacks that might otherwise leak information about the recovery phrase.

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timing clues, adds bounds checks to prevent reading past the end of the input buffer, and clears sensitive buffers before returning on error. The changes are defensive and reduce side-channel and out-of-bounds risks, but the commit message frames them as feedback responses needing testing, so it is not a finished security fix.

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each word is, or where word boundaries fall. The change is defensive: it makes the parsing routine run in constant time and on a fixed-size buffer, reducing side-channel leakage. There is no claim in the commit that an actual exploit exists.

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely read every entry without accidentally touching memory past the end of a short word. It also removes noisy timing-test thresholds that could fail on shared CI machines and keeps only a stricter statistical correlation check. The change is explicitly described by the developer as an early 'first pass' that still needs testing and evaluation, so it is not a finished security fix.

This commit fixes a missing safety limit in the Passport hardware wallet's microSD message-signing feature. Previously, a user could accidentally or maliciously be asked to sign an extremely large file from the microSD card, which could strain memory, cause crashes, or be used in a denial-of-service-style attack. The change restores a maximum file-size check that existed in older code but was lost when two code paths were merged. Health-check files are exempt because they already have their own built-in size limits.

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an explicit 'expected address' check. The microSD signing path already had this safety check. After the change, the raw, verified address is passed through and used to confirm the signature is for the correct address, while a stylized version is still shown on screen. This reduces the risk that a tricked or confused user signs a message with the wrong address.

This commit fixes a minor return-value bug in the Passport hardware wallet's health-check flow. When the user cancels message signing, the flow now returns 'None' instead of 'False'. This is a correctness fix that likely prevents a downstream caller from misinterpreting a user cancellation as a failed health check. There is no direct evidence in the commit that this is exploitable for theft, bypass, or denial of service.

This firmware update fixes two issues in the Passport hardware wallet's message-signing feature. First, it adds a user confirmation screen when signing a message from a microSD card in normal (non-health-check) mode, so the user can see the message and the address that will sign it before approving. Second, it corrects the exported message signature text format so wallet software like Sparrow can parse it properly. Previously, the signature block used generic BEGIN/END SIGNATURE labels instead of blockchain-specific ones, which could cause import failures.

This commit is a routine code cleanup. It removes an unused 'view_text' parameter from a warning screen and fixes a minor text linting issue. There is no security-relevant change.

This commit changes the on-screen warnings shown to users before they view their wallet recovery seed words. It adds clearer anti-scam language and an extra confirmation step, but does not change how seed words are stored, generated, or protected. There is no security vulnerability in the code change itself.

This commit is a routine user-interface polish change. It adds a new list-style icon for the 'Explore Addresses' menu item in the Passport hardware wallet firmware, replacing the previous verify-address icon. It also makes two minor build-script tweaks (changing the Python interpreter path from /usr/bin/python3 to /usr/bin/env python3) and adds a missing copyright header to one image file. There is no security-relevant change.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match and used a normal string comparison, so an attacker measuring tiny time differences might learn which words were entered. The new version always scans the entire word list and compares words in constant time, making the process take the same amount of time regardless of the phrase. A new test checks that timing does not vary with the word positions.

This commit suppresses a compiler warning about using the address of a short-lived local variable to track the top of the program's stack. The underlying code behavior is unchanged; only the warning is silenced. There is no direct security fix here, though the pattern itself is a known, long-standing MicroPython idiom for estimating stack usage.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the code no longer wraps the data in a 'Message' object before creating a Schnorr signature. On its own, this looks like a routine compatibility update, but because it touches security-critical code (digital signatures), it warrants careful review to ensure the new calling pattern is safe and does not bypass any intended message-validation step.

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for health checks, just with different on-screen labels and file filters. There is no indication in the code that this weakens security or introduces a vulnerability; it appears to be a normal feature addition.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no security fixes, and no functional changes to the firmware.