CommitWatch RSS
KS
← All projectsKeystone

Keystone 3 firmware

Open-source device firmware for Keystone 3 hardware wallets.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

536 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

111security candidates287second-pass queue401AI analyses
119commits · 30 days
159commits · 60 days
276commits · 180 days
535commits · 365 days
Backfill bands
Aug 5 → Feb 6260 seen14 candidatesComplete
Feb 6 → Jun 6117 seen7 candidatesComplete
Jun 6 → Jul 639 seen4 candidatesComplete
Jul 6 → Aug 5115 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

41/100 average clarity
35Strong · 80–100
64Adequate · 60–79
204Thin · 40–59
233Opaque · 0–39
38security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Adam Tucker931148163
aaron30412148
ww351268717652165026
soralit1153470048
willwang15214025
John Boyd623088
Soralit321058
Qkin-Keystone26123036
qkin12111050
Greg Pfeil412071
Daira-Emma Hopwood211085
bianminyan45042032
Analysis record

Published AI watches

Last scanned 6 minutes ago

Moderate 59 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2260 from KeystoneHQ/replace-lvgl-rand

This commit replaces the on-screen keyboard shuffle and a word-list randomizer so they use the device's true random-number generator (TRNG) instead of LVGL's weaker pseudo-random function. The change is defensive: it removes a source of pr…

Replaced pseudo-random generator with hardware TRNG in security-sensitive shuffle operationsRemoved fixed-range modulo reduction bias source (`lv_rand(0, 2048) % n`)Changed include from LVGL UI library to device TRNG driver in utility code
230abd77by Soralit+8−32 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

replace lvgl rand

This commit swaps out the LVGL graphics library's pseudo-random number generator for the device's hardware true random number generator (TRNG) in two places: shuffling the on-screen numeric keypad and shuffling recovery-word lists. The old…

Replacement of non-cryptographic PRNG with hardware TRNG in security-sensitive shuffle routinesFisher-Yates shuffle of on-screen PIN keypad now uses TrngGetFisher-Yates shuffle of mnemonic word array now uses TrngGet
f7d64fb8by ww3512687+8−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(simulator): return password error on PIN mismatch in SimulatorLoadAccountSecret

This commit fixes a bug in the firmware's simulator (a software stand-in used for testing, not the real hardware wallet). When checking a stored account password/PIN, the simulator was accidentally returning 'success' even when the passwor…

Incorrect success return on authentication failure in simulator-only codeMismatch between simulator and real-device authentication error semanticsFunctional regression in multi-account PIN creation in simulator builds
6bec6930by soralit+4−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: address Solana review findings

This commit improves how Keystone 3's Solana app recognizes and displays certain transaction types. It adds support for the Solana Compute Budget program so those instructions are no longer labeled as 'Unknown,' and it adds parsing for Sol…

Previously unknown Compute Budget instructions are now parsed and labeled, reducing the chance a user approves a transaction they cannot understand.Off-chain signing messages are parsed with format and length validation, so wallet-connect-style sign-in messages are shown as text rather than misinterpreted as transactions.Unknown program accounts are surfaced explicitly in the UI instead of being hidden inside a generic 'Unknown' instruction list.
e1752174by soralit+343−5711 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 47 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: remove implementation plan

This commit only deletes a planning document from the repository's docs folder. No firmware code, build scripts, or cryptographic logic were changed. The deleted file described a previously completed security-hardening task about removing …

Deleted document references a prior security-hardening task (issue #2255 / PRNG fallback removal)No source-code or build-system changes in the diff
4620fe94by ww3512687+0−1041 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove insecure PRNG fallback

This commit removes a weak, predictable random-number generator that was bundled as a backup inside the firmware's SLIP-39 code. Previously, if the device's proper hardware random source was accidentally left out of a build, the firmware c…

Removal of deterministic LCG PRNG (random32)Removal of weak-symbol random_buffer fallbackRemoval of unused random helper APIs
17c78e30by ww3512687+108−693 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 10 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci

This commit is described as a routine CI (continuous integration) update with only one line changed in a release-related file. No code changes affecting wallet security, cryptography, or user funds are visible, and no security relevance is…

39cfff13by soralit+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: regular AI code review and fix

This is a large, routine code-quality and hardening patch for the Keystone 3 hardware wallet firmware. It tightens how transactions are parsed and displayed for several cryptocurrencies (Arweave, Avalanche, Bitcoin, Cosmos, Ethereum, Solan…

Arweave: duplicate required tags now rejected, malformed/trailing Avro data now rejectedArweave: DataItem tag count mismatch now rejectedAvalanche: trailing transaction bytes now rejected via parsed_size checks
e2c0ef31by soralit+3998−142676 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 85 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: guard Solana USB pubkey service for non-web3 builds

This commit fixes a firmware build problem, not a runtime security bug. The Solana USB public-key service was calling a function that only exists in the multi-coin 'web3' firmware variant, so the more limited 'cypherpunk' and 'bitcoin-only…

Build/link-time failure fix for conditional feature compilationExplicit error response added for unsupported coin type on non-web3 buildsNo input validation, memory safety, or cryptographic changes observed
9d04150dby John Boyd+10−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

optimize sol derivation path allocation

This commit refactors how a Solana cryptocurrency derivation path is stored while parsing a USB request. Previously, the code dynamically allocated a small heap buffer inside a helper function and returned it to the caller, which then had …

Eliminates heap allocation for a fixed-size derivation-path bufferRemoves manual free responsibility from caller, reducing memory leak / use-after-free riskSwitches helper return type from pointer to bool to enforce explicit success/failure handling
9c3efd94by ww3512687+12−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: upgrade rust version

This commit upgrades the Rust compiler toolchain from one nightly version to a newer one and adjusts code to keep the project building and tests passing. It does not fix a known security bug or change how user funds are protected. Most of …

82a48133by soralit+511−1321 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

support sol cli

This commit adds Solana CLI support to the Keystone 3 hardware wallet firmware. It introduces a new USB command that lets a connected computer request public keys for specific Solana derivation paths, and it reworks how USB responses are s…

New USB command exposes public-key export for a specific coin type and derivation pathAdded NULL/empty checks before returning generated UR data and before using cached passwordMoved several UR result sends from synchronous to asynchronous (task-queue based) dispatch
77833f49by ww3512687+282−2016 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Preserve Zcash account firmware version (#37)

This commit is a small, non-security code change. It updates a Zcash wallet test to verify that the firmware version string is preserved when account data is encoded and decoded, and it switches two Rust library dependencies from the publi…

Dependency source changed from crates.io to a third-party Git repository (valargroup/keystone-sdk-rust)No mention of vulnerability, CVE, security fix, or researcher attribution in commit message or diffChange is limited to a unit test assertion and dependency source pinning
20d7ea2dby Adam+11−73 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Preserve PCZT v1 response encoding

This commit changes how the Keystone hardware wallet handles Zcash PCZT (partially-created transaction) files. Previously, after checking and signing a transaction, the device always returned the result in the newer v2 format. Now it remem…

Behavioral change in serialization format selectionNew parsing helper reads wire version from raw bytesTest coverage added for v1 preservation
acf3611aby Adam Tucker+136−245 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 67 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

test(zcash): harden v1 PCZT end-to-end coverage

This commit only adds and updates test code for the Zcash PCZT (Partially-Created Zcash Transaction) feature. It hardens end-to-end test coverage for version 1 PCZTs that include both transparent and Orchard shielded inputs/outputs. There …

No production code changesTest-only commitAdds defensive assertions for signature finalization behavior
2c54cb53by Adam Tucker+177−363 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): use shielded pool display directly

This commit is a minor code cleanup in the Zcash shielded-transaction handling code. It removes temporary variables named `pool_label` and instead uses the existing `pool` value directly when building error messages. There is no change to …

9074e087by Adam Tucker+22−334 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): validate transparent PCZT formats

This commit tightens validation for Zcash transaction formats (PCZT) on the Keystone 3 hardware wallet. Previously, the firmware only checked that a transaction was version 6 or higher and not v6 specifically, plus that it had no Sapling o…

Input-validation hardening for transaction parsing/signingExplicit allow-listing of supported (tx_version, version_group_id, orchard_revision) tuplesNew negative test for v6 + Nu6 branch rejection
0d02c355by Adam Tucker+80−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): allow transparent-only V6 PCZTs

This commit changes how Keystone's Zcash transaction handling treats version 6 (V6) PCZTs. Previously, all V6 Zcash transactions were rejected in the non-cypherpunk (transparent-only) code path. The patch now allows V6 transactions as long…

Guard relaxation: V6 PCZTs no longer blanket-rejected in transparent-only buildsBoundary enforcement remains for shielded Sapling/Orchard/Ironwood contentUnknown transaction versions still rejected
ba4ecf28by Adam Tucker+127−954 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): validate empty shielded bundle balances

This commit adds a validation check for Zcash PCZT (Partially Created Zcash Transaction) parsing in the Keystone hardware wallet firmware. It ensures that if an Orchard or Ironwood shielded bundle contains no actions, its declared value su…

Input validation added for empty shielded bundle value_sumPotential balance-consistency issue in Zcash PCZT handlingTest case demonstrates malformed PCZT rejection
5e05a21aby Adam Tucker+99−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 10 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci

This commit is described as a routine CI (Continuous Integration) update with only one line changed in one file. No diff content is available, and there are no verified references suggesting any security relevance. It appears to be a munda…

7f2c4423by soralit+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedfix cypherpunk buildby ww3512687 · 1eaf6501 · Jan 6, 2026 · 1 fileMessage 28 · OpaqueInformational 18Details
Commit message · ww3512687

fix cypherpunk build

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 18/100

This commit fixes a build error in a special firmware variant called 'cypherpunk' (also referred to as BTC_ONLY). It changes which cryptocurrency address settings are used when the firmware is compiled without certain optional features. There is no direct evidence this is a security vulnerability; it appears to be a build-breakage fix that could affect which coin's receive/address settings appear in the UI.

AI review queuedfix ui bugsby ww3512687 · b01d5444 · Jan 6, 2026 · 1 fileMessage 0 · OpaqueInformational 11Details
Commit message · ww3512687

fix ui bugs

0/100 · OpaqueMessage clarity
! Very short subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 11/100

This commit changes how wallet names are listed in the status bar for different product build variants (Web3, Cypherpunk, Bitcoin-only). It also adds a debug printf statement that prints a wallet name to the console. There is no clear security issue visible in the diff itself.

AI review queuedfixby ww3512687 · 91f8ed5e · Jan 6, 2026 · 3 filesMessage 0 · OpaqueInformational 15Details
Commit message · ww3512687

fix

0/100 · OpaqueMessage clarity
! Generic or placeholder subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only changes on-screen wallet names and a minor UI display rule. There is no security issue here—it is a cosmetic/branding update.

AI review queuedfix btc-only buildby ww3512687 · bc828faf · Jan 6, 2026 · 1 fileMessage 28 · OpaqueInformational 20Details
Commit message · ww3512687

fix btc-only build

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 20/100

This commit fixes a build error in the Bitcoin-only version of the Keystone 3 firmware. It wraps Litecoin-specific code with a compile-time flag so that code is excluded when building the firmware variant that only supports Bitcoin. There is no direct security vulnerability being patched; it is a build-configuration fix.

AI review queuedadd 2.3.4 changelogby bianminyan · 3277974d · Jan 5, 2026 · 3 filesMessage 38 · OpaqueInformational 15Details
Commit message · bianminyan

add 2.3.4 changelog

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds a new changelog entry for firmware version 2.3.4 and bumps the build number from 2 to 4. It contains no code changes, bug fixes, or security-related content. There is nothing in the diff that affects device security or user funds.

AI review queuedcode coverageby ww3512687 · 5252d420 · Jan 5, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · ww3512687

code coverage

28/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds and updates unit tests for the Bitcoin Rust module. It does not change any production code behavior. There is no security-relevant change to the firmware itself.

AI review queuedfix cargo testby ww3512687 · a154d099 · Jan 5, 2026 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · ww3512687

fix cargo test

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates test code so that automated Rust tests compile and pass again. It does not change any production wallet code, so it cannot directly affect user funds or device security.

AI review queuedadd ltc iconby ww3512687 · 95a1f061 · Jan 5, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · ww3512687

add ltc icon

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply adds a Litecoin (LTC) icon to a list of coin icons shown in the wallet connection screen. It is a cosmetic UI change with no security relevance.

AI review queued1. update wallet list 2. set native defaultby ww3512687 · e90f55cd · Jan 5, 2026 · 12 filesMessage 60 · AdequateInformational 15Details
Commit message · ww3512687

1. update wallet list
2. set native default

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine product update for the Keystone 3 hardware wallet firmware. It refreshes the list of supported software wallets shown on the device, updates related icons and translated text, and changes the default Bitcoin address type to the wallet's native/default format. There is no indication of a security vulnerability or fix in the changes.

Security candidatesupport ltc nativeby ww3512687 · 602868d4 · Jan 5, 2026 · 13 filesMessage 28 · OpaqueInformational 15Details
Commit message · ww3512687

support ltc native

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit adds support for Litecoin (LTC) native SegWit addresses (the 'ltc1...' format) to the Keystone 3 hardware wallet firmware. It is a feature addition: it lets users generate and display a new type of LTC address and export the corresponding public key. There is no indication in the commit that it fixes a security bug or vulnerability.

Lower-priorityfix: add ltc native xpub to parse contextby soralit · e732d059 · Jan 5, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · soralit

fix: add ltc native xpub to parse context

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefix: simulator buildby soralit · d72ef089 · Jan 5, 2026 · 3 filesMessage 40 · ThinInformational 18Details
Commit message · soralit

fix: simulator build

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 18/100

This commit fixes the firmware's build for a software simulator. It removes an unused public-key derivation step in Bitcoin PSBT handling, relaxes a hardware-only flash-read assertion when compiling the simulator, and adds a simulator-only header. There is no clear security fix for real hardware; the changes are build-compatibility adjustments.

AI review queuedUpdate version for testby bianminyan · ed366ab0 · Dec 30, 2025 · 1 fileMessage 38 · OpaqueInformational 15Details
Commit message · bianminyan

Update version for test

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only changes one number in a version header file, bumping the build version from 0 to 2. There is no functional code change, no bug fix, and no security-related modification. It appears to be a routine version update for testing or release tracking.

AI review queuedadd jupiter walletby ww3512687 · e3ccb877 · Dec 30, 2025 · 9 filesMessage 28 · OpaqueInformational 15Details
Commit message · ww3512687

add jupiter wallet

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds support for a new wallet partner called Jupiter to the Keystone 3 hardware wallet firmware. It is a routine feature addition: a new logo image, an updated image hash, a new entry in the wallet connection list, and related UI label updates. There is no indication of a security fix or vulnerability.

AI review queuedadd ltc iconby ww3512687 · a0f5be10 · Dec 29, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · ww3512687

add ltc icon

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply adds a Litecoin (LTC) icon to a list of coin icons shown in the wallet connection screen. It is a cosmetic UI change with no security relevance.

AI review queued1. update wallet list 2. set native defaultby ww3512687 · 95fcf63c · Dec 29, 2025 · 13 filesMessage 60 · AdequateInformational 15Details
Commit message · ww3512687

1. update wallet list
2. set native default

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine product update for the Keystone 3 hardware wallet firmware. It refreshes the list of supported software wallets shown in the UI, updates translated text strings, and adds new font glyphs (Chinese, Japanese, Korean) needed for those strings. There is no visible security-relevant code change in the diff.

Lower-priorityfix: add ltc native xpub to parse contextby soralit · 87bc3912 · Dec 25, 2025 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · soralit

fix: add ltc native xpub to parse context

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatesupport ltc nativeby ww3512687 · d8a6ce3b · Dec 25, 2025 · 13 filesMessage 28 · OpaqueInformational 12Details
Commit message · ww3512687

support ltc native

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 12/100

This commit adds support for Litecoin (LTC) native SegWit addresses (the 'ltc1...' format) to the Keystone 3 hardware wallet firmware. It is a feature addition: it lets users generate and display LTC native SegWit receive addresses, export the corresponding extended public key, and includes new UI labels and a tutorial. There is no indication in the commit that this fixes a security bug or introduces a vulnerability.

Security candidatefix: simulator buildby soralit · 1967ea1a · Dec 25, 2025 · 3 filesMessage 40 · ThinInformational 12Details
Commit message · soralit

fix: simulator build

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 12/100

This commit fixes build errors in the simulator (non-production) build of the Keystone 3 firmware. It removes an unused public-key derivation step in Bitcoin PSBT handling, relaxes a hardware flash-read assertion when compiling for the simulator, and adds a simulator-only header include. There is no evidence of a security vulnerability being patched.

Security candidatefeat: hide change output on legacy transactionby soralit · 6c95fec9 · Dec 24, 2025 · 1 fileMessage 57 · ThinInformational 19Details
Commit message · soralit

feat: hide change output on legacy transaction

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 19/100

This commit changes how the Keystone 3 hardware wallet displays Bitcoin transaction recipients. Specifically, it hides the 'change' label on outputs that return bitcoin to the user's own wallet when the transaction comes from a 'legacy' format. This is a user-interface change, not a fix for stealing funds. It may reduce user clarity during transaction review, but it does not by itself allow an attacker to move coins.

AI review queuedadd 2.3.2 changelogby bianminyan · ed41710b · Dec 24, 2025 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · bianminyan

add 2.3.2 changelog

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds text to two changelog files describing a new firmware version (2.3.2). It does not change any source code, so it cannot introduce or fix a security vulnerability by itself. The changelog mentions a bug fix for TON-only message signing, but the actual code change is not present in this commit.

Lower-priorityfeat: adjust uiby soralit · c7d5554b · Dec 23, 2025 · 1 fileMessage 40 · ThinTriage 0Details
Commit message · soralit

feat: adjust ui

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatefix: psbt output parsingby soralit · 7b971924 · Dec 23, 2025 · 2 filesMessage 40 · ThinModerate 59Details
Commit message · soralit

fix: psbt output parsing

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Moderate 59/100

This commit fixes how the Keystone 3 hardware wallet parses Bitcoin PSBT (Partially Signed Bitcoin Transaction) outputs. The change adds verification that an output's Bitcoin address actually matches the public key and derivation path claimed in the transaction, rather than trusting the PSBT's output metadata blindly. If the previous code accepted incorrect or attacker-controlled output data, a user could be tricked into approving a transaction that sends funds to an unexpected address. The commit also refactors some address-calculation code into a shared helper.

Security candidatefeat: adjust change output uiby soralit · 80702379 · Dec 23, 2025 · 6 filesMessage 57 · ThinInformational 19Details
Commit message · soralit

feat: adjust change output ui

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet pathparser or protocol path
AI analysis · Informational 19/100

This commit changes how the Keystone hardware wallet labels Bitcoin transaction outputs on its screen. It adds a new 'is_mine' flag and shows 'Change' or 'Receive' labels next to outputs that belong to the user's own wallet. The goal appears to be helping users more easily recognize their own change outputs during transaction review, which is a usability and anti-confusion improvement rather than a fix for an exploitable vulnerability.

AI review queuedfix: simulator buildby soralit · ac4349bd · Dec 23, 2025 · 4 filesMessage 40 · ThinInformational 15Details
Commit message · soralit

fix: simulator build

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine build fix for the firmware simulator. It adds a helper macro that lets a function return NULL on error, fixes a function name typo in a MetaMask wallet helper, and adjusts safe-string macros so they return 0 like their standard-library counterparts. None of these changes appear to be security fixes.