Keystone 3 firmware

This commit fixes a build error in the 'cyperpunk' firmware variant by replacing a likely-undefined variable `len` with `seedLen` in two function calls that handle Zcash cryptographic key derivation. The change appears to be a straightforward compile fix rather than a security patch, but the use of the wrong variable could theoretically have led to reading an incorrect seed length if `len` had a different meaning or value.

This commit cleans up two places where TON (The Open Network) checksums were being converted to hex strings by hand-written loops, replacing them with a single helper function `ByteArrayToHexStr`. It also adds a debug print statement showing whether the TON and BIP39 mnemonic comparisons succeeded during the 'forget TON' flow. The title 'fix ton forget' suggests the change is meant to fix a bug in the process of forgetting/removing a TON wallet, but the diff itself does not show an obvious security vulnerability or a clear behavioral fix beyond code simplification and extra logging.

This commit changes how Cardano public keys are derived for SLIP39 wallets. It switches from a mutable, zeroed-out copy of the wallet seed to a non-mutable, non-zeroed copy. The change removes a safety feature that normally wipes the seed from memory after use, which could leave sensitive seed material in memory longer than intended. However, the commit message only says 'fix ada slip39 address' and gives no security explanation, so the exact risk is unclear from the diff alone.

This commit replaces a custom secure-wipe function with a standard one in code that handles secret key material during password-based key derivation. The change is likely a defensive hardening fix, but the diff alone does not prove an exploitable vulnerability existed.

This commit fixes a logic bug in the Keystone hardware wallet's SLIP39 backup phrase handling. The original code used 'OR' instead of 'AND' when checking word counts, which made the validation always fail for valid 20-word and 33-word SLIP39 phrases. This would have shown users an incorrect error notice and blocked legitimate wallet recovery or setup operations. It is a bug fix that improves reliability, but it does not appear to allow theft of funds on its own.

This commit simply removes four unused helper functions for handling JSON data from a utility file. There is no change to active behavior, no bug fix, and no security-relevant change.

This firmware update fixes a bug in how the Keystone 3 hardware wallet handles TON (The Open Network) wallet setup. The changes remove several safety checks and replace safer string/buffer functions with less safe ones, while also restructuring how TON entropy and seed generation errors are handled. The commit title says it fixes a TON wallet bug, but the diff itself mostly removes defensive coding patterns rather than adding them. Without more context, it is unclear whether the change fully resolves the underlying issue or introduces new risks.

This commit removes a function that filled public key info for all cryptocurrency chains and adds a null-password check in the RSA key-reading path. The stated goal is to fix a crash. The crash likely happened because RSA key generation/reading ran while the password cache was empty, causing GetAccountSeed to dereference a null password. Removing the broad chain-info filler may also prevent crashes from partially initialized state during wallet setup or account switching.

This commit fixes a mismatch in how the firmware stores a recovery phrase (mnemonic) in memory. Previously, the code allocated memory based on the actual phrase length but then copied the phrase using a fixed maximum size. The change makes both steps use the same, correct length. This is a defensive fix that prevents potential memory corruption or undefined behavior when handling the secret recovery phrase.

This commit changes a password-length check from 'greater than' to 'greater than or equal to' the minimum allowed length. In the original code, a password exactly equal to the minimum length would trigger an assertion failure, which could crash the firmware or block wallet operations. The fix allows passwords of exactly the minimum length to be accepted. This is a correctness fix for an input-validation boundary condition, but the commit message gives no indication it was treated as a security issue by the vendor.

This commit fixes a memory-freeing mismatch in the Keystone 3 hardware wallet firmware. The code was freeing a memory block using the wrong allocator (EXT_FREE instead of SRAM_FREE). Such mismatches can corrupt memory and cause the device to crash or behave unpredictably. The commit title says 'fix crash,' but no further details are provided, and there is no independent evidence that this is exploitable for security harm rather than just a stability bug.

This commit is a large refactor of Bitcoin-related code in the Keystone 3 firmware. Most changes add unit tests, clean up formatting, and reorganize C code into smaller helper functions. There are a few small functional changes in how Taproot PSBT signing status is tracked and how seed length is obtained, but no obvious security vulnerability is introduced. The refactor also adds explicit clearing of the seed buffer after signing, which is a minor security improvement.

This commit makes two clean-up changes to Tron transaction handling in the Keystone 3 firmware. First, it avoids calling the same formatting functions twice by reusing computed values. Second, it improves how the signing code handles the wallet's secret seed: it now initializes the seed buffer to the correct size, checks whether retrieving the seed succeeded before using it, and securely wipes the seed from memory even if signing fails. These are defensive hardening improvements rather than a fix for a known active exploit, but they reduce the risk that a failed seed retrieval or leftover seed data could lead to incorrect signing or information leakage.

This commit fixes three small but real code-quality issues in the Keystone 3 hardware wallet firmware: a global device-settings variable was made private to one file, a memory leak was plugged in the log-reading code, and screen brightness is now capped at a safe maximum. The commit message is just a typo-filled 'reivew device setting', so the vendor did not describe these as security fixes. The changes are defensive hardening rather than an obvious exploit fix.

This commit is a large code cleanup and refactoring of the wallet connection feature in the Keystone 3 firmware. It removes many duplicated Rust modules and C functions that generated QR-code sync data for specific wallets (Aptos, Solana, Sui, XBull, Keystone companion app, etc.) and replaces them with a single generic function. It also fixes some memory leaks by adding SRAM_FREE calls and removes unused/commented-out code. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance refactor.

This commit fixes a logic bug in how Bitcoin multisig wallet policies are validated and cleans up several related code paths. The most important change corrects a flawed condition that could have allowed invalid or nonsensical multisig policies (for example, a threshold of zero or a threshold larger than the total number of signers) to be accepted. It also improves memory safety by adding proper cleanup of secret seed data and freeing a previously unfreed response object, and it removes weak-symbol function stubs that could have led to unexpected behavior when Bitcoin-only features are disabled.

This commit updates Ethereum signing code in a cryptocurrency hardware wallet firmware so that the secret seed (master key) is wiped from memory immediately after use. It also replaces several 'unwrap' crash points with proper error handling. The main security improvement is reducing the window where the seed sits in memory after signing, which could lower the risk of an attacker reading it from device RAM. However, the patch is partial: it only covers three Ethereum signing functions and does not appear to add zeroize to all signing paths in the firmware.

This commit is a cleanup and hardening pass on how the Keystone 3 hardware wallet handles camera images, SD card files, and debug/test code. The most user-relevant change is that file-reading functions now refuse to load very large files from the SD card, which closes a path where an oversized file could exhaust device memory. Several debug helpers that could print sensitive file contents or cryptographic hashes over the serial port, plus a leftover firmware-copy routine, are removed. A camera preview buffer is also made safer by freeing it on re-init instead of leaking memory. The commit message is vague ('review data flow') and does not call this a security fix, so the security relevance is inferred from the code changes rather than stated by the vendor.

This commit is a code cleanup that removes a dedicated imToken wallet connection module and routes imToken through the existing MetaMask-style connection code. It also adds the ability to include the wallet name when generating connection data for MetaMask-compatible wallets. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit is a code review and cleanup of Ethereum-related code in the Keystone 3 hardware wallet firmware. It adds many unit tests, fixes a typo in a function name (sign_fee_markey_tx → sign_fee_market_tx), replaces some static variables with constants, and fixes a few minor logic issues. The most user-visible change is adding a check for an SD card before trying to load external contract data, and fixing memory leaks where global pointers could be overwritten without freeing the old data. There is no clear evidence of an active security vulnerability being patched, but the memory management and contract-data-loading changes are defensive improvements.

This commit only reformats whitespace in test code and updates one test's expected value for a contract-creation transaction's destination address from an empty '0x' to the zero address. It does not change any production code or fix a security issue.

This commit is a security-focused code review and hardening pass on account and secret handling in the Keystone 3 hardware wallet firmware. It replaces unsafe string and memory functions (strcpy, sprintf, memcpy) with safer bounded versions, removes debug printf leaks of sensitive data, fixes a bug where a new-password cache overwrote the password cache, adds compile-time guards against shipping test keys in production, and hardens JSON parsing against malformed flash data. These are defensive improvements that reduce the risk of buffer overflows, information leaks, and accidental weakening of secure-element protections.

This commit only adds new automated tests for the Tron cryptocurrency transaction handling code in a hardware wallet firmware project. It does not change any production behavior, fix bugs, or introduce new features. There is no security-relevant change visible in the diff.