Keystone 3 firmware

This commit fixes how the Keystone hardware wallet parses 'signmessage' QR code requests from SeedSigner. Previously, the code split the message at every colon, so a message containing colons would be cut off and only the first part would be signed. Now it splits only at the first colon and rejects empty messages. A truncated or altered message could lead to signing something different from what the user intended, which is a security concern for message signing workflows.

This commit only updates unit tests for the Avalanche transaction parser. It swaps test blockchain IDs from mainnet to testnet values, removes debug print statements, fixes an import order warning, and replaces placeholder assertions with real ones. There is no change to production code that handles user funds or device security.

This commit fixes a minor user-interface navigation bug during the wallet recovery phrase import flow. When a user is importing a single recovery phrase and reaches the step for writing it to the secure element, the back/previous button could skip the wrong screen or behave oddly if no passphrase is needed. The fix adjusts which screen the user is sent back to. There is no direct evidence this is a security vulnerability.

This is a large cleanup commit titled 'chore: fix warning'. It removes compiler warnings across many Rust modules by deleting unused imports, switching to modern Rust syntax, and fixing minor style issues. The most notable functional change is in the Monero code, where randomness for key-image generation and encryption now comes from the operating system's secure random source (OsRng) instead of a deterministic seed derived from the request data. That change is a security improvement, not a vulnerability. There is no clear evidence in the commit of an exploitable security bug.

This commit only adds a changelog entry for firmware version 2.2.18. It describes two new features (DOGE transaction/PSBT parsing) and one bug fix (XMR Key Image generation error), but it does not modify any source code, cryptographic logic, or configuration. There is nothing in the diff that introduces or fixes a security vulnerability.

This commit is a routine cleanup of Rust compiler warnings (Clippy lints). It removes unused imports, rewrites idiomatically cleaner code, fixes variable naming, and updates a few function signatures. There is no indication it fixes a security vulnerability or changes security-critical behavior.

This commit simply comments out a single automated test for Monero transaction signing. It does not change any production code, so it cannot directly introduce or fix a security vulnerability in the firmware that users run. The test is disabled, which means the code it exercises is no longer automatically verified, but the commit itself does not alter how Monero transactions are signed.

This commit simply bumps a build number in a version header from 16 to 18. There are no code changes, no bug fixes, and no security-related modifications visible in the diff.

This commit simply switches two internal Rust library dependencies from a development branch to a numbered release tag (0.0.52). It is a routine dependency pinning change with no visible security fix or vulnerability in the diff itself.

This commit removes leftover debugging code from the Keystone 3 firmware. The most notable change is that in production builds, the device's debug UART output is now replaced with harmless '-' characters instead of potentially leaking real data. Other changes remove hard-coded test values and re-enable a normal boot-version check that had been bypassed. These are cleanup fixes that reduce the chance of sensitive information leaking through debug interfaces or test code being active in production.

This commit is purely a code cleanup: it runs the Rust formatter (fmt) and applies Clippy lint suggestions. The changes are cosmetic—reformatting lines, reordering imports, removing unused imports, and adding 'unsafe' markers to functions that already contained unsafe operations. There is no functional change to how the firmware handles keys, transactions, or user data, and no security vulnerability is introduced or fixed.

This commit is purely a code-formatting change ('cargo fmt') in a Monero signing utility. It rewraps a single function call onto one line instead of multiple lines without changing any logic, values, or behavior. There is no security relevance.

This commit is a routine code cleanup. It removes two blank lines and replaces a length check (`len() == 0`) with the idiomatic Rust method `is_empty()`. These changes do not alter how the Monero app works and do not fix or introduce any security issue.

This commit adds one line that turns off a 'quick access' toggle for the passphrase feature whenever the passphrase text is cleared. Without this fix, the toggle could stay enabled unexpectedly, potentially causing the device to remember or expose passphrase-related settings in a state the user did not intend. The change is defensive and improves safety, but the diff alone does not prove an exploitable vulnerability exists.

This commit only adds release notes for firmware version 2.2.16. It does not change any executable code, configuration, or security logic. The changelog describes two new user-facing features—an optional PIN shuffle toggle and the ability to set up a passphrase wallet during initial wallet creation or import—but these are product announcements, not a security patch or vulnerability fix.

This commit only fixes a formatting issue in the Chinese changelog by replacing a stray backslash with a blank line. No code, firmware logic, or security behavior was changed.

This commit only edits a Chinese-language changelog file, adding a blank line and a stray backslash. No code, configuration, or security behavior is changed.

This commit adds code that clears the optional passphrase text from the screen and resets its visibility to hidden (password mode) whenever the user navigates back from passphrase entry during wallet creation, import, or settings. It also refactors how the 'show/hide' eye icon is controlled. The change looks like a cleanup fix to prevent a sensitive passphrase from lingering on screen or staying visible after a user leaves the page, which could reduce the risk of shoulder-surfing or accidental disclosure.

This commit adjusts when on-screen navigation buttons appear during the wallet backup and restore workflows for SLIP39 secret shares. It moves the hiding of the right navigation button so it is only removed on the specific screens where it is not needed, rather than removing it earlier in the flow. This is a user-interface polish change; there is no direct evidence in the commit that it fixes a security vulnerability.

This commit only changes a single number in a version header file, bumping the build version from 14 to 16. There is no code change that affects security, functionality, or behavior of the firmware.

This is a large code-cleanup commit titled 'fix: run fmt and rust fix'. It applies Rust formatting, clippy lint fixes, and removes unstable nightly feature flags across many Rust files in the Keystone 3 firmware. The changes are mostly stylistic or idiomatic (e.g., replacing manual loops with while-let, using OsRng instead of deterministic seeds for Monero bulletproofs/CLSAG signatures, changing pointer-safety annotations to unsafe, and removing unused imports). There is no explicit vendor statement that this fixes a security vulnerability, and the diff does not show a clear, exploitable bug fix. However, the Monero RNG change is a meaningful functional change that could affect cryptographic security if the prior deterministic seeding was flawed, and the broad unsafe FFI annotation changes could hide or expose memory-safety issues. Overall the commit appears to be a routine refactor/tooling fix rather than a targeted security patch.

This commit removes unused variables, unused function declarations, and unused local arrays across several firmware source files, and adds a couple of missing header includes. It also changes a few function signatures from `char *` to `const char *` for string parameters that are not modified. The stated purpose is simply to 'fix warning' (compiler warnings). None of these changes alter program logic, security boundaries, or cryptographic handling.

This commit fixes a user-interface label bug. When a user has a TON (The Open Network) wallet, the device now shows the correct message explaining that TON cannot be combined with Bitcoin or Ethereum-style accounts because the seed phrase is incompatible. It only changes on-screen text and its translations; no security-sensitive code is modified.

This commit simply swaps one icon image for another in the wallet creation screen. It changes the picture shown next to the 'change entropy' menu option from a generic connection icon to a dice icon. There is no security-relevant change.

This commit adds the ability to set a BIP-39 passphrase during wallet creation and import, not just afterward in settings. Most of the change is UI flow wiring, but it also fixes a small bug in the SLIP-39 salt construction and adds a length check for passphrases. There is no clear security vulnerability introduced by the patch itself; the main risk is that passphrase handling is complex and any mistake could lock users out of funds or, in edge cases, weaken key derivation.