Keystone 3 firmware

This commit updates Ethereum signing code in a cryptocurrency hardware wallet firmware so that the secret seed (master key) is wiped from memory immediately after use. It also replaces several 'unwrap' crash points with proper error handling. The main security improvement is reducing the window where the seed sits in memory after signing, which could lower the risk of an attacker reading it from device RAM. However, the patch is partial: it only covers three Ethereum signing functions and does not appear to add zeroize to all signing paths in the firmware.

This commit is a large code cleanup and refactoring of the wallet connection feature in the Keystone 3 firmware. It removes many duplicated Rust modules and C functions that generated QR-code sync data for specific wallets (Aptos, Solana, Sui, XBull, Keystone companion app, etc.) and replaces them with a single generic function. It also fixes some memory leaks by adding SRAM_FREE calls and removes unused/commented-out code. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance refactor.

This commit only reformats whitespace in test code and updates one test's expected value for a contract-creation transaction's destination address from an empty '0x' to the zero address. It does not change any production code or fix a security issue.

This commit is a code review and cleanup of Ethereum-related code in the Keystone 3 hardware wallet firmware. It adds many unit tests, fixes a typo in a function name (sign_fee_markey_tx → sign_fee_market_tx), replaces some static variables with constants, and fixes a few minor logic issues. The most user-visible change is adding a check for an SD card before trying to load external contract data, and fixing memory leaks where global pointers could be overwritten without freeing the old data. There is no clear evidence of an active security vulnerability being patched, but the memory management and contract-data-loading changes are defensive improvements.

This commit fixes a logic bug in how Bitcoin multisig wallet policies are validated and cleans up several related code paths. The most important change corrects a flawed condition that could have allowed invalid or nonsensical multisig policies (for example, a threshold of zero or a threshold larger than the total number of signers) to be accepted. It also improves memory safety by adding proper cleanup of secret seed data and freeing a previously unfreed response object, and it removes weak-symbol function stubs that could have led to unexpected behavior when Bitcoin-only features are disabled.

This commit is a large refactor of Bitcoin-related code in the Keystone 3 firmware. Most changes add unit tests, clean up formatting, and reorganize C code into smaller helper functions. There are a few small functional changes in how Taproot PSBT signing status is tracked and how seed length is obtained, but no obvious security vulnerability is introduced. The refactor also adds explicit clearing of the seed buffer after signing, which is a minor security improvement.

This commit is a routine code-quality and test-coverage update for the TON (The Open Network) wallet code in the Keystone 3 firmware. It replaces several Rust `.unwrap()` calls with proper error handling, adds many unit tests, and improves how sensitive seed data is cleared from memory after signing. There is no direct evidence in the commit that these changes fix an active exploit; they look like defensive hardening and cleanup.

This commit is mostly a routine cleanup and test-addition patch for Zcash support in the Keystone 3 firmware. It adds many Rust unit tests for error handling, PCZT parsing, and data structures, fixes a Cardano test that had an empty expected value, removes a stray blank line, and refactors the Zcash signing UI flow to use a shared internal helper. There is no direct evidence in the diff of a security vulnerability being fixed.

This commit is a code-review hardening pass for the Cardano wallet module in the Keystone 3 firmware. It replaces many Rust `.unwrap()` calls with proper error handling, adds bounds checks for derivation paths and public keys, zeroizes sensitive seed/entropy buffers after use, and fixes a seed-length bug for BIP39 vs SLIP39 accounts. Most changes reduce the chance that malformed transaction data or missing key material causes a crash or leaks secrets, but the commit is broad and includes many test additions, so it is better characterized as defensive cleanup than a single fixed vulnerability.

This commit is a code review and cleanup of the Cosmos cryptocurrency support in the Keystone 3 hardware wallet firmware. It fixes several small but real issues: it corrects a buffer-size mismatch when copying passwords/passphrases into memory, avoids unnecessary cloning of transaction data, adds zeroing of the seed buffer after signing, and fixes memory leaks and repeated JSON parsing in the Cosmos UI code. There is no clear evidence of an exploitable remote attack, but the changes reduce the chance of memory corruption and secret leakage.

This commit is purely a code-formatting cleanup ("cargo fmt") on Rust files in the Avalanche app. It changes whitespace, line breaks, and import order, but does not alter any program logic, behavior, or security checks. There is no security issue here.

This commit only adds unit tests to the Aptos Rust app. It does not change any production code, so it cannot introduce a security vulnerability or fix one. The tests exercise existing functions for address generation, transaction parsing, message decoding, signing, and various data-type helpers.

This commit temporarily disables the NEAR blockchain app from the Keystone 3 firmware build. It does not fix or introduce any security vulnerability; it is a build configuration change that removes NEAR from automated testing and the multi-coin feature list while keeping the source code present. There is no evidence this change is related to a security issue.

This commit is a code-quality and hardening review of the Aptos blockchain support in the Keystone 3 hardware wallet firmware. It adds input validation (e.g., public keys must be exactly 32 bytes), removes risky simulator-only code paths that could dereference null pointers, fixes memory leaks and seed-handling bugs, and tightens how derivation paths and master fingerprints are extracted from signing requests. There is no explicit vendor statement that these changes fix a security vulnerability, but several of the corrected patterns are classic sources of bugs that could affect wallet safety.

This commit only renames some Rust source directories from capital letters (C_chain, P_chain) to lowercase (c_chain, p_chain). The actual code inside the files is unchanged. It is a cosmetic cleanup with no security relevance.

This commit only reorders two Rust import/use statements in a single source file. It makes no functional change to the code and does not affect program behavior or security.

This commit is a code review and cleanup pass for the Avalanche (AVAX) app in the Keystone 3 hardware wallet firmware. It fixes typos in transaction type names, adds a few length checks before reading transaction bytes, replaces direct low-level signing with a safer helper, and consolidates signing code so AVAX, IOTA, and SUI share the same secure path. Most changes are defensive hardening and refactoring rather than a single obvious critical bug fix.

This commit only adds new automated tests for the Sui blockchain app in the Keystone hardware wallet firmware. It checks that address generation rejects invalid or wrong-length public keys and that transaction-intent parsing rejects empty input and invalid scope bytes. No production code behavior was changed.

This commit only adds new unit tests to the Sui app in the Keystone 3 firmware. It does not change any production code, fix bugs, or alter behavior. The tests check things like UTF-8 decoding rules, address generation error cases, intent parsing, and signature determinism. There is no security issue in the commit itself.