KS
← All projectsKeystone

Keystone 3 firmware

Open-source device firmware for Keystone 3 hardware wallets.

BitcoinHardware walletsNormal
Repository coverage

532 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

107security candidates287second-pass queue45AI analyses
116commits · 30 days
155commits · 60 days
272commits · 180 days
532commits · 365 days
Backfill bands
Aug 5 → Feb 6260 seen14 candidatesComplete
Feb 6 → Jun 6117 seen7 candidatesComplete
Jun 6 → Jul 639 seen4 candidatesComplete
Jul 6 → Aug 5115 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

41/100 average clarity
35Strong · 80–100
64Adequate · 60–79
201Thin · 40–59
232Opaque · 0–39
37security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
ww35126871755121026
soralit1143315048
Adam Tucker93115063
aaron3041048
willwang1521025
John Boyd621088
Qkin-Keystone2610036
qkin1211050
Greg Pfeil410071
Daira-Emma Hopwood210085
bianminyan4500032
stone wang300038
Analysis record

Published AI watches

Last scanned 44 minutes ago

Moderate 64 AI analysisMessage 80 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: remove insecure PRNG fallback

This commit removes a weak, predictable random-number generator that was bundled as a backup inside the firmware's SLIP-39 code. Previously, if the device's proper hardware random source was accidentally left out of a build, the firmware c…

Removal of deterministic LCG PRNG (random32)Removal of weak-symbol random_buffer fallbackRemoval of unused random helper APIs
17c78e30by ww3512687+108−693 files
Vendor flagged security relevance
Moderate 64 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Scope Zcash shielded signing to selected account

This commit fixes a bug in the Keystone 3 hardware wallet's Zcash shielded transaction signing. Previously, when a user reviewed and approved a transaction for one account, the device could accidentally authorize a spend from a different a…

Account-scoping enforcement added to shielded spend authorizationPrevents cross-account signing under same seedNew validation in PCZT check path before signing
3d14c7ddby Adam Tucker+166−296 files
Vendor flagged security relevance
Low 43 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): skip finalized dummy spends during signing

This commit fixes a bug in the Keystone hardware wallet's Zcash signing code. When signing a batch of Zcash transactions that include 'dummy' placeholder spends (zero-value decoy actions used for privacy), the signer could get stuck or fai…

Zcash privacy-spend signing bypass for finalized dummy actionsBatch-transport redaction state reproduced in regression testPotential signing failure / denial-of-service for Zcash PCZT transactions with dummy spends
9792998aby Adam Tucker+81−13 files
No security note in commit
Informational 15 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

refactor(zcash): rename redacted PCZT signing helper

This commit is a simple rename of an internal function from `sign_pczt_to_pczt` to `sign_and_redact_pczt` in the Zcash Rust code. No behavior, logic, or security properties changed; it only makes the function name more descriptive. There i…

01bd8e2bby Adam Tucker+4−42 files
No security note in commit
Moderate 59 AI analysisMessage 100 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(se): Move 2 W1 — SE generation detection, gen-isolated backend, gen-1 page-8 gate

This is a large firmware commit for the Keystone 3 hardware wallet that restructures how the secure element (SE) chip is used. It introduces a generation-aware backend so the firmware can support two different SE configurations (gen-1, the…

Generation-aware SE backend with fail-closed NULL backend for UNPROVISIONED/INVALID chipsLegacy page-8 PIN-hash wipe gated to gen-1 only to avoid erasing gen-2 R_wrappedPer-account lifecycle status pages for atomic crash recovery of create/change-PIN/delete
57a92dcdby aaron+2163−16736 files
Vendor flagged security relevance
Moderate 54 AI analysisMessage 100 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix(zcash): sign shielded PCZTs without RoleSigner to fit the device stack

This commit fixes a crash in the Keystone hardware wallet when signing certain advanced Zcash transactions. The previous code used a heavy upstream signing helper that needed too much memory, causing the device to reset during an Orchard-t…

Stack overflow / device reset in signing task due to excessive stack usage by upstream RoleSignerReplacement of heavy upstream signer with lean in-repo low_level_signer to fit device stack budgetAddition of consensus-critical NU6.3 v6 Orchard/Ironwood sighash domains in pczt_ext
11592ebcby Adam Tucker+603−2173 files
No security note in commit
Low 37 AI analysisMessage 45 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Add Zcash batch signing for shielded PCZTs

This commit adds a new Zcash batch-signing feature for shielded transactions and fixes a UI bug where Zcash signing could freeze if the response QR code could not be generated. The changes introduce new Rust code to validate, parse, and si…

New batch signing path for Zcash shielded PCZTs with 35-message limitAtomic batch semantics: any invalid message aborts the whole batchPreflight check `ensure_pczt_has_signable_shielded_action` prevents silent no-signature results
745330f6by Adam Tucker+2201−5232 files
Vendor flagged security relevance
Low 35 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat: update dice roll entropy ui

This commit updates the user interface and internal checks for generating wallet seed phrases using dice rolls as a source of randomness. It enforces a minimum number of dice rolls depending on the desired seed strength: at least 50 rolls …

Enforces minimum entropy input length based on target mnemonic strengthAdds server-side/model-layer validation in addition to UI gatingPrevents generation of 256-bit seeds from insufficient dice-roll entropy
7bc4d7d8by soralit+158−168 files
No security note in commit
Informational 15 AI analysisMessage 0 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

leap sunset

This commit removes support for the 'Leap' wallet from the Keystone 3 firmware. It deletes the Leap wallet icon and asset, removes Leap-related text strings from Chinese, Japanese, and Korean font files, and updates the Rust dependency ver…

920e9830by ww3512687+609−88123 files
No security note in commit
Low 29 AI analysisMessage 100 · Strong
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(zcash): enable Zcash for SLIP 39 wallets with 33-word shares

This commit changes how the Keystone hardware wallet enables Zcash for SLIP 39 wallets. Previously, Zcash was completely disabled for all SLIP 39 wallets. Now it is allowed when the SLIP 39 shares are 33 words long (256-bit entropy), but s…

Relaxation of a security-motivated disablement based on entropy lengthNew entropy-length gate for Zcash supportPotential risk if entropy length check is bypassed or miscalculated
2729141bby John Boyd+46−269 files
Vendor flagged security relevance
Low 35 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat(nufi-tron): update nufi-tron support

This commit adds a new way for the Keystone hardware wallet to handle Tron (TRX) transactions sent as plain JSON sign requests, alongside the older Keystone-specific format. It introduces code that parses JSON, derives the sender address f…

New transaction parsing path from untrusted JSON input (serde_json::Value then protoc::TronTx)Address-ownership check added before signing (derived address vs. JSON 'from' field)Use of keccak256 with slicing `digest[12..]` to form 20-byte TRON address
c9cc587eby qkin+571−1713 files
No security note in commit
Low 26 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

support core wallet

This commit adds support for the Core Wallet in the Keystone 3 firmware. It mainly expands the number of Avalanche X/P-chain derivation paths from one to ten, updates the Rust SDK dependency, and changes how signing requests extract deriva…

Change to cryptographic signing API (multiple paths / multiple signatures)Change to HD derivation path validation and selection logicChange to master-fingerprint / source-fingerprint verification
fa8a0579by ww3512687+165−13711 files
No security note in commit
Low 27 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

support core wallet

This commit adds support for the Core Wallet in the Keystone 3 firmware. It mainly expands the number of Avalanche (AVAX) X/P-chain account paths from one to ten, updates the Rust signing code to accept multiple derivation paths from the w…

Change from hardcoded derivation-path derivation to paths supplied by the signing requestAddition of multiple AVAX X/P-chain account indexes (0-9)Signature generation now iterates over multiple provided paths
cbcd90c1by ww3512687+165−13711 files
No security note in commit
Informational 15 AI analysisMessage 50 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Remove the redundant code and comments related to TON

This commit removes the special 'TON-only wallet' feature from the Keystone 3 firmware. It deletes code that let users create or import a TON-native 24-word seed phrase separate from the normal BIP39 wallet. After this change, TON is handl…

No security-relevant signals present in the diff or commit metadataFeature removal, not a vulnerability patchNo mention of CVE, security advisory, researcher credit, or exploit in commit message
abe8f0b7by ww3512687+91−169342 files
No security note in commit
Moderate 61 AI analysisMessage 67 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

feat: improve update security, support X Layer, and refresh Zodl wallet integration

This firmware update for the Keystone 3 hardware wallet is billed as a security improvement. The most important change is a complete rewrite of the bootloader/firmware update path: it now uses SHA-256 and a signed/length-prefixed 'bootupda…

Bootloader/firmware update verification upgraded from MD5 to SHA-256 with length-prefixed magic headerAUTO_REBOOT_AFTER_COPY_FILE path removed from USB MSC SCSI handler, eliminating host-triggered reboot on file copyUSB endpoint address validation added across DCD, USBD core, and class drivers to prevent out-of-bounds EP array access
c42b3eebby ww3512687+3821−98482 files
Vendor flagged security relevance
Moderate 57 AI analysisMessage 0 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

boot update

This commit is a large firmware update for the Keystone 3 hardware wallet, primarily adding a bootloader update mechanism and hardening the USB stack. It introduces a way to overwrite the device's bootloader from a specially formatted regi…

New bootloader self-update path from application flash with magic-number header, SHA-256 hash, and CRC32 verificationFlash encryption enabled for production builds using OTP-derived AES-CBC key/IVUSB control endpoint hardening: request length validation, descriptor bounds checks, endpoint address validation, stall-on-invalid requests
4df8c325by ww3512687+3369−73160 files
No security note in commit
Informational 20 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: zcash transparent is not signing

This is a one-line build-configuration fix for the Keystone hardware wallet's Zcash signing code. Previously, transparent Zcash transaction signing was only enabled when the 'multi_coins' feature was active. The change also enables it when…

No memory-safety issues visible in the diffNo cryptographic algorithm changesNo input validation changes
18300002by soralit+1−11 file
No security note in commit
Low 41 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: zcash transparent is not signing

This is a one-line build-configuration fix for the Keystone hardware wallet's Zcash transparent transaction signing. Previously, the code that signs the transparent (non-shielded) part of a Zcash PCZT transaction was only compiled when the…

Functional bug in cryptographic signing pathBuild-feature conditional compilation errorCould produce invalid/incomplete transaction signatures
635fc76eby soralit+1−11 file
No security note in commit
Informational 15 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

support gero wallet

This commit adds support for a new wallet partner called Gero Wallet in the Keystone 3 firmware. It is a routine feature addition: a new icon, a new entry in wallet lists, a tutorial link, and recognition of the wallet's origin name when h…

254e8157by ww3512687+112−712 files
No security note in commit
Informational 17 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: keystone slip39 not support zcash

This commit fixes a product limitation: Keystone 3 hardware wallets using a SLIP39-style recovery phrase could not connect to the Keystone mobile app for Zcash. The patch removes Zcash from the list of coins shared when a SLIP39 wallet is …

Functional/compatibility fix for SLIP39 Zcash supportInput validation added for zcash seed fingerprint length (must be 0 or 32)No evidence of buffer overflow, use-after-free, or cryptographic weakness in the patch
2ff0478eby soralit+70−127 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedrefactor(zcash): use shielded pool display directlyby Adam Tucker · 9074e087 · Jul 21, 2026 · 4 filesMessage 62 · AdequateTriage 12Details
Commit message · Adam Tucker

refactor(zcash): use shielded pool display directly

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-priorityfix(zcash): validate transparent PCZT formatsby Adam Tucker · 0d02c355 · Jul 21, 2026 · 2 filesMessage 57 · ThinTriage 8Details
Commit message · Adam Tucker

fix(zcash): validate transparent PCZT formats

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
defensive validation
Lower-prioritytest(zcash): restore v1 PCZT end-to-end coverageby Adam Tucker · 75b69553 · Jul 21, 2026 · 2 filesMessage 67 · AdequateTriage 0Details
Commit message · Adam Tucker

test(zcash): restore v1 PCZT end-to-end coverage

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritybuild(zcash): use released protocol cratesby Adam Tucker · ef5ad05f · Jul 21, 2026 · 4 filesMessage 80 · StrongTriage 0Details
Commit message · Adam Tucker

build(zcash): use released protocol crates

Use crates.io releases for PCZT, Orchard, and the librustzcash crate family. Keep ur-registry patched to the merged SDK revision until its updated batch envelope is published.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Lower-prioritytest(zcash): restore transparent-output PCZT coverageby Adam Tucker · 4bdf2148 · Jul 21, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Adam Tucker

test(zcash): restore transparent-output PCZT coverage

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI review queuedfix(zcash): allow transparent-only V6 PCZTsby Adam Tucker · ba4ecf28 · Jul 21, 2026 · 4 filesMessage 57 · ThinTriage 12Details
Commit message · Adam Tucker

fix(zcash): allow transparent-only V6 PCZTs

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-priorityfix(zcash): validate empty shielded bundle balancesby Adam Tucker · 5e05a21a · Jul 21, 2026 · 1 fileMessage 62 · AdequateTriage 8Details
Commit message · Adam Tucker

fix(zcash): validate empty shielded bundle balances

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
defensive validation
Security candidatechore: update ciby soralit · 7f2c4423 · Jul 21, 2026 · 1 fileMessage 40 · ThinTriage 12Details
Commit message · soralit

chore: update ci

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
Lower-priorityfix(zcash): require an owned singleton inputby Adam Tucker · 4277d422 · Jul 21, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · Adam Tucker

fix(zcash): require an owned singleton input

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedrefactor(zcash): simplify unsupported PCZT helpersby Adam Tucker · 0f0dc78a · Jul 21, 2026 · 3 filesMessage 62 · AdequateTriage 12Details
Commit message · Adam Tucker

refactor(zcash): simplify unsupported PCZT helpers

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedrefactor(zcash): display shielded pool namesby Adam Tucker · 83ac1e21 · Jul 21, 2026 · 4 filesMessage 57 · ThinTriage 12Details
Commit message · Adam Tucker

refactor(zcash): display shielded pool names

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Security candidatefix(zcash): defer checked batch cleanup after signingby Adam Tucker · 3b8995fa · Jul 20, 2026 · 1 fileMessage 62 · AdequateTriage 18Details
Commit message · Adam Tucker

fix(zcash): defer checked batch cleanup after signing

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundary
Lower-priorityfix(zcash): initialize batch parse fingerprintby Adam Tucker · 56df2725 · Jul 20, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Adam Tucker

fix(zcash): initialize batch parse fingerprint

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfix(zcash): guard batch refresh display stateby Adam Tucker · c634f1ca · Jul 20, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Adam Tucker

fix(zcash): guard batch refresh display state

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedfix(zcash): size UFVK buffers for terminatorsby Adam Tucker · 5f158dd3 · Jul 20, 2026 · 6 filesMessage 57 · ThinTriage 12Details
Commit message · Adam Tucker

fix(zcash): size UFVK buffers for terminators

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-priorityfix the cn and ru words wrap and too long issueby aaron · 2dfd881d · Jul 20, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · aaron

fix the cn and ru words wrap and too long issue

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedadd 3.0.0 changelogby bianminyan · 15bf55fd · Jul 20, 2026 · 3 filesMessage 38 · OpaqueTriage 0Details
Commit message · bianminyan

add 3.0.0 changelog

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedSet Zcash batch limit to 40by Adam Tucker · 7fd64609 · Jul 18, 2026 · 2 filesMessage 45 · ThinTriage 7Details
Commit message · Adam Tucker

Set Zcash batch limit to 40

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
Security candidateRelease Zcash batch review widgets before signingby Adam Tucker · 2982da56 · Jul 18, 2026 · 1 fileMessage 45 · ThinTriage 18Details
Commit message · Adam Tucker

Release Zcash batch review widgets before signing

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundary
AI review queuedRestore Zcash batch limit to 35by Adam Tucker · 480e0cd1 · Jul 18, 2026 · 2 filesMessage 45 · ThinTriage 7Details
Commit message · Adam Tucker

Restore Zcash batch limit to 35

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedSet Zcash batch limit to 40by Adam · 51cae26e · Jul 18, 2026 · 2 filesMessage 45 · ThinTriage 7Details
Commit message · Adam

Set Zcash batch limit to 40

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI review queuedReduce Zcash batch limit to 35by Adam Tucker · 13662ea0 · Jul 18, 2026 · 2 filesMessage 45 · ThinTriage 7Details
Commit message · Adam Tucker

Reduce Zcash batch limit to 35

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
Lower-priorityshorten the words on others language to fix the UI issueby aaron · 95cf02e6 · Jul 17, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · aaron

shorten the words on others language to fix the UI issue

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedfix the verifying ps hang on wrong password in btc only multi-sigby aaron · 2037a16a · Jul 17, 2026 · 2 filesMessage 50 · ThinTriage 12Details
Commit message · aaron

fix the verifying ps hang on wrong password in btc only multi-sig

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
Lower-priorityapply the fix for the model overlap issue on proverownership pageby aaron · 029efbdd · Jul 17, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · aaron

apply the fix for the model overlap issue on proverownership page

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body