Keystone 3 firmware

This commit fixes a Zcash transaction-checking bug in the Keystone 3 hardware wallet firmware. A maliciously crafted transaction could make an output look like the wallet's own change by using the wallet's internal viewing key, even though the money actually went to an attacker's address. The fix adds a check that any output decrypted with the internal key really belongs to the wallet, and adds a regression test that reproduces the attack scenario.

This commit fixes the build process for a software simulator used during development. It adds a missing dependency for the Sui cryptocurrency app, wraps a real-device bootloader update check so it is excluded from simulator builds, and provides a simulator-only stub that always returns 'no update needed.' There is no indication this change affects real hardware security or user funds.

This commit fixes a bug in the Keystone hardware wallet's Zcash transaction parsing. Previously, the wallet incorrectly labeled certain P2SH (pay-to-script-hash) outputs as 'change' going back to the user's own wallet, when it should not have. This could mislead a user into thinking a payment was just internal change, when it was actually going to someone else. The fix hardcodes these outputs as not-change.

This commit fixes a validation gap in the Keystone hardware wallet's Zcash transaction checking code. Previously, a partially-created Zcash transaction (PCZT) could claim a non-zero Sapling shielded value even when the Sapling bundle contained no actual inputs or outputs. The fix now rejects such inconsistent PCZTs before signing. If accepted, a malformed transaction could potentially mislead the user about value flows or lead to an invalid signature.

This commit simply swaps the on-screen icon for the Keplr wallet. It updates a PNG image, its matching C-language embedded copy, and a hash file used to track assets. There is no code change, no security fix, and no behavior change beyond the new picture.

This commit adds a one-time reset of a 'recovery mode switch' flag during device startup. The change makes the device clear the recovery-mode marker if it matches an expected magic value and then saves the updated boot settings. Without more context, it looks like a hardening or bug-fix change that prevents a recovery-mode state from persisting unexpectedly across reboots, which could otherwise affect how the device boots or whether it exposes recovery features.

This commit fixes two minor UI issues. First, it corrects the displayed text for an Avalanche (AVAX) wallet derivation path so the placeholder for the account number is shown inside single quotes (X') instead of outside them, matching the actual BIP-44 path format. Second, it cleans up an incorrect include guard in a header file that was using the wrong macro name and an extra unnecessary #endif. Neither change affects security.

This commit is a pure code-formatting change. It removes an unnecessary line break in a Rust match arm, making the code style consistent with the surrounding code. There is no functional change, no bug fix, and no security relevance.

This commit adds support for the Core Wallet in the Keystone 3 firmware. It mainly expands the number of Avalanche X/P-chain derivation paths from one to ten, updates the Rust SDK dependency, and changes how signing requests extract derivation paths and fingerprints. There is no explicit security fix or vulnerability disclosure in the commit message or diff. The changes are feature-oriented, but they touch sensitive code paths (transaction signing, HD path handling, and master-fingerprint checks), so they warrant careful review.

This commit adds support for the Core Wallet in the Keystone 3 firmware. It mainly expands the number of Avalanche (AVAX) X/P-chain account paths from one to ten, updates the Rust signing code to accept multiple derivation paths from the wallet instead of hardcoding a single one, and bumps the Rust UR registry library version. There is no explicit security fix or vulnerability patch visible in the diff; it reads as a feature/integration change.

This commit changes two Japanese translation strings for Cardano-related labels in the Keystone 3 hardware wallet firmware. One string in a CSV file is updated from a katakana-only rendering to include the English word 'Cardano' with a Japanese suffix, and the matching compiled string in a C source file is updated the same way. There is no code behavior change, no security fix, and no vulnerability signal.

This commit fixes translation strings for a Cardano wallet label. It corrects mismatched language entries so that Spanish, Japanese, Korean, and Russian users see the label in their own language instead of seeing Korean, Chinese, or English text by mistake. There is no security change.

This commit is a tiny UI-only change for the NuFi wallet connection screen. It increases the declared size of an image array from 4 to 5 so that a fifth cryptocurrency icon (likely TRON/TRX) can be added. There is no security-relevant change visible in the diff.

This firmware patch changes how TON (The Open Network) wallet public keys are regenerated and how the wallet's 'manage' flag is set. Previously, TON wallets were skipped during normal public-key regeneration and were given a special 'manage' flag. The fix removes those special cases so TON wallets go through the same key-generation path as other wallets, and it prevents public-key switching for TON mnemonics. The change appears to correct a functional bug where TON wallet data could become stale or inconsistent after regenerating or switching accounts, but the commit does not describe it as a security vulnerability.

This commit updates translation strings and adds a new Polish language file for the Keystone 3 firmware's user interface. It changes wording about TON wallet deletion and removes some obsolete TON-related labels, but it does not modify any security logic, cryptography, or code that handles secrets.

This commit removes a conditional compilation guard (#ifdef BUILD_PRODUCTION) around some software version-related function declarations in a header file. The stated purpose is simply to fix a build failure. There is no indication of any security issue in the change itself.

This commit simply adds TRON (TRX) as a supported coin icon for the NuFi wallet connection screen in the Keystone hardware wallet firmware. It is a routine feature addition with no visible security implications.

This appears to be a routine CI (Continuous Integration) configuration update with no visible security relevance. Only one file was changed with a single-line addition and deletion, and the diff content is unavailable. There is no evidence of a security fix or vulnerability.

This commit is purely a code-formatting cleanup. It reorders an import, breaks a few long assert lines into multiple lines, and removes extra blank lines. There are no functional changes to the firmware or any security-relevant behavior.

This commit only adds unit tests for existing TON (The Open Network) message parsing code. It does not change any production behavior, fix bugs, or alter how the firmware handles real transactions. The tests verify that Jetton, NFT, comment, and error-conversion routines behave as already implemented.

This commit removes the special 'TON-only wallet' feature from the Keystone 3 firmware. It deletes code that let users create or import a TON-native 24-word seed phrase separate from the normal BIP39 wallet. After this change, TON is handled like other coins using a standard BIP39-derived key. There is no security bug being fixed here; it is a feature-removal cleanup.

This is a one-line change to a CI/release file titled 'chore: update ci'. No actual code changes are shown, and no security-relevant content can be identified from the available information.

This commit adds a small piece of code that writes a fixed 'magic number' marker to flash memory after a successful bootloader update. The marker is stored in the last 4 KB of the application flash region. This is likely intended as a flag so the system can later detect that a boot update has occurred. The change itself is not obviously malicious, but it modifies sensitive boot-update logic and writes to flash, so it deserves careful review in context.

This commit adds a small piece of firmware code that stores a fixed 15-byte pattern of bytes and a function that reads and mixes those bytes during device startup. On its own, the change does not appear to introduce a vulnerability; it looks like a compatibility or update-related marker. However, the purpose is not explained in the commit message, and the code is not obviously connected to any security-critical function, so its exact role is unclear from the diff alone.

This is a one-line change to a CI/release file titled 'chore: update ci'. No diff content is available, and there are no verified references suggesting security relevance. Based solely on the metadata, there is no indication this commit fixes or introduces a security issue.