CommitWatch RSS
KS
← All projectsKeystone

Keystone 3 firmware

Open-source device firmware for Keystone 3 hardware wallets.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

553 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

119security candidates294second-pass queue551AI analyses
7commits · 30 days
37commits · 60 days
279commits · 180 days
504commits · 365 days
Backfill bands
Aug 5 → Feb 6260 seen14 candidatesComplete
Feb 6 → Jun 6117 seen7 candidatesComplete
Jun 6 → Jul 639 seen4 candidatesComplete
Jul 6 → Aug 5115 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

42/100 average clarity
35Strong · 80–100
72Adequate · 60–79
211Thin · 40–59
235Opaque · 0–39
39security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
soralit11634116248
Adam Tucker931193263
aaron30430248
Soralit959154
ww351268717652176026
willwang15215025
John Boyd626088
github-actions[bot]323076
Aaron Chen222068
Qkin-Keystone26126036
qkin12112050
Greg Pfeil414071
Analysis record

Published AI watches

Last scanned 24 minutes ago

Low 42 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2293 from KeystoneHQ/merge/v3.1.0

This is a large firmware release merge (v3.1.0) for the Keystone 3 hardware wallet. The visible changes are mostly a major FreeRTOS kernel upgrade (from v10.x to v11.3.0), build-system improvements, and user-facing feature tweaks such as b…

FreeRTOS kernel major version upgrade (10.x -> 11.3.0) with MPU hardeningSwitch from ARM_CM4F non-MPU port to ARM_CM4_MPU portNew MPU configuration flags: configTOTAL_MPU_REGIONS=8, configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1, configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0
0c0ae467by stone+59616−26981300 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 48 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci (#2292)

This commit only updates a Git submodule pointer in a release-tracking file. The actual code change is a one-line pointer update from one commit hash to another in a file named 'keystone3-firmware-release'. There is no visible security-rel…

90d1c789by Soralit+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. No source code, build scripts, CI configuration, or security-related files are changed in the visible diff. There is no evidence…

a7f6db29by Soralit+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

release 3.1.0

This is a large firmware release commit (version 3.1.0) for the Keystone 3 hardware wallet. The most significant change visible in the diff is a major upgrade of the FreeRTOS real-time operating system kernel from version 10.x to 11.3.0, c…

FreeRTOS major version upgrade (10.x → 11.3.0) with MPU port enabledNew MPU sandbox task/runtime/validator files addedconfigENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1 and configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0 set
2b007a29by Soralit+59615−26980300 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.8 (#2291)

This commit is a routine version-bump merge for release v3.0.8. It only updates changelogs, a Git submodule pointer, and a build version number. There is no code change visible in the diff and nothing that suggests a security fix or vulner…

b5e8f9fcby github-actions[bot]+18−24 files
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.6 (#2290)

This firmware update adds support for Solana's new V1 transaction format and changes how oversized or malformed transaction details are displayed. The code introduces a dedicated parser for V1 messages with strict size and structure checks…

New parser enforces hard limits on V1 message fields and rejects malformed 0x81-prefix payloads instead of falling back to message signingCompute-budget instructions in V1 are explicitly ignored to prevent fee-display spoofingUI pagination change for large transaction details reduces truncation risk
87b78ae1by github-actions[bot]+564−2812 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

pin to new release config (#2285)

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. There is no code change visible in the diff, no description of what the new release config contains, and no security-related inf…

bc01c889by Aaron Chen+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

update the release repo (#2282)

This commit simply updates a Git submodule pointer for the project's release repository. There is no visible code change, no description of any security issue, and no indication this is anything other than a routine release-tracking update.

3ac7e802by Aaron Chen+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.4 (#2279)

This is a routine firmware release merge (v3.0.4) for the Keystone 3 hardware wallet. The bulk of the changes are UI tweaks, new feature support (Solana CLI, Lace Wallet), and hardening fixes found during an internal 'regular AI review'. T…

NUL-byte rejection in EIP-712 typed data parsingC-string conversion hardening against NUL bytesNull-pointer and UTF-8 validation added to UR parsing entry points
6ab436a2by github-actions[bot]+4960−548845 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 59 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Build fix (#2273)

This commit is a routine build-system and code-formatting fix. It resets cached CMake build options so each build starts from known defaults, makes cbindgen header-generation failures visible instead of silently ignored, runs Rust formatti…

8568a657by stone wang+8−145 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 36 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

limit file count (#2272)

This commit adds a hard cap on how many files the device will list from its SD card when loading multi-signature Bitcoin wallet data. It also tightens up null-pointer and length checks while scanning directories. The likely goal is to prev…

Unbounded directory listing now bounded by FATFS_MAX_FILE_NUMBERNull-pointer guards added for fileName, number, and path parametersLength checks added before copying filenames into caller buffers
de6879c3by stone wang+31−146 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 73 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2268 from KeystoneHQ/regular-review-fix

This commit tightens which old-style Bitcoin-like transactions the Keystone hardware wallet will accept. It now rejects raw protobuf Bitcoin (BTC) and Dogecoin (DOGE) legacy UTXO transactions, allowing only Bitcoin Cash (BCH), Dash (DASH),…

Deprecation of raw-protobuf Bitcoin transaction handlingRejection of unsupported legacy UTXO variants at multiple entry pointsShift from coin_code string matching to protobuf variant matching for legacy path eligibility
1c70d3d4by Soralit+134−166 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: mark legacy utxo transaction as deprecated and disable btc legacy transactions

This commit disables the older, raw-protobuf signing path for Bitcoin and Dogecoin transactions in the Keystone 3 hardware wallet firmware. It keeps the legacy path active only for Bitcoin Cash (BCH), Dash (DASH), and Litecoin (LTC). The c…

Disables a legacy transaction parsing/signing code path for Bitcoin and DogecoinAdds explicit rejection checks before raw transaction parsing, checking, signing, and view routingSwitches discriminator from coin_code string to protobuf transaction variant to prevent spoofing
1fcd2346by Soralit+134−166 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2264 from KeystoneHQ/regular-review-fix

This firmware update is a routine 'regular review fix' that hardens how the Keystone 3 hardware wallet checks and displays several cryptocurrency transactions before signing. The most important security changes are: (1) the sign button is …

Sign slider disabled until parse success prevents premature approvalArweave DataItem tag-count mismatch now rejected in pre-checkAvalanche transaction re-validated by type in pre-check, tampered asset ID rejected
87c7e7e2by Soralit+623−20423 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 67 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2263 from KeystoneHQ/driver-optimize

This commit updates the hardware random number generator (TRNG) driver in a cryptocurrency hardware wallet firmware. It adds detection for a physical fault/attack signal from the TRNG and, if triggered, wipes the random data and aborts via…

Added TRNG fault/attack status detection (TRNG_IT_RNG0_ATTACK)Zeroization of sensitive local buffer and output buffer on TRNG failureAssertion abort on detected TRNG attack condition
a409efe0by Soralit+29−51 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 18 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

driver optimzie

This commit updates the hardware random number generator (TRNG) driver in a cryptocurrency hardware wallet firmware. It adds detection for a physical tamper/attack signal from the TRNG chip and, if an attack is detected, wipes the random d…

New check of TRNG_IT_RNG0_ATTACK tamper/attack interrupt statusFailure path now zeroes output and local buffer before abortingAddition of ASSERT guards and secure memset_s usage
25f3d951by ww3512687+29−51 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: regular ai review fix

This firmware update for the Keystone 3 hardware wallet fixes several security and safety issues found during an internal AI-assisted review. The most important changes are: (1) the signing slider is now disabled until a transaction is ful…

Signing slider disabled until parse success prevents approval of malformed transactionsArweave DataItem tag-count mismatch rejected in pre-check before confirmation pageAvalanche transaction re-validated by type during fingerprint check
edbeae79by soralit+623−20423 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2262 from KeystoneHQ/regular-review-fix

This firmware update fixes several security and safety issues found during a regular AI-assisted code review. The most important changes are: (1) Zcash wallet data is now encrypted with a key derived from the wallet seed and a fresh random…

Zcash UFVK encryption key changed from sha256(password) to seed-derived BIP32 keyZcash UFVK IV changed from deterministic seed-derived value to fresh TRNG-generated IV per blobZcash UFVK storage format now uses magic-prefixed blob with embedded IV and rejects legacy blobs
04d942ffby Soralit+1852−52633 files
No security note in commit
Open full analysis →Source commit ↗
High 80 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: regular AI review and fix

This firmware update fixes several security and safety issues found during an internal AI-assisted review. The most important changes are: (1) Zcash wallet data was being encrypted with a key derived from the user's login password and a fi…

Zcash UFVK encryption key changed from sha256(login password) to seed-derived BIP32 keyZcash UFVK IV changed from deterministic seed-derived value to fresh TRNG-generated IV per encryptionNew 'z2' UFVK blob format stores IV with ciphertext; legacy blobs rejected/migrated
776d8832by soralit+1852−52633 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2260 from KeystoneHQ/replace-lvgl-rand

This commit replaces the on-screen keyboard shuffle and a word-list randomizer so they use the device's true random-number generator (TRNG) instead of LVGL's weaker pseudo-random function. The change is defensive: it removes a source of pr…

Replaced pseudo-random generator with hardware TRNG in security-sensitive shuffle operationsRemoved fixed-range modulo reduction bias source (`lv_rand(0, 2048) % n`)Changed include from LVGL UI library to device TRNG driver in utility code
230abd77by Soralit+8−32 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedUpdate versionby bianminyan · 9a7a438c · Aug 6, 2025 · 1 fileMessage 18 · OpaqueInformational 15Details
Commit message · bianminyan

Update version

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only changes one number in a version header, bumping the firmware build version from 4 to 6. There is no code behavior change, no bug fix, and no security-related content visible in the diff.