Keystone 3 firmware

This commit only updates the product changelog and bumps the firmware build version number from 2.4.2 to 2.4.4. It contains no code changes, no bug fixes, and no security-related modifications. The changelog mentions routine items such as removing a wallet connection entry, adding a Zcash backup feature, and fixing a loading issue, but these are just documentation notes for a release; the actual code changes are not present in this commit.

This commit removes support for the 'Leap' wallet from the Keystone 3 firmware. It deletes the Leap wallet icon and asset, removes Leap-related text strings from Chinese, Japanese, and Korean font files, and updates the Rust dependency versions for the UR (Uniform Resources) parsing libraries used by the firmware. There is no indication of a security fix or vulnerability being patched.

This commit updates the TON (The Open Network) cell serialization code in the Keystone 3 firmware to use a newer version of the bitstream-io library. The changes are mostly mechanical renames of method calls (e.g., write/read becomes write_var/read_var) to match the new library's API. There is no explicit security fix described in the commit, and the diff alone does not show a patched vulnerability. It appears to be a dependency maintenance change.

This commit fixes a UI counting bug in the Keystone hardware wallet's home screen. Previously, disabled cryptocurrency assets were still being counted when calculating how many wallets were shown in the asset management view. The fix ensures disabled assets are excluded from the count and their checkbox state is cleared. There is no direct evidence this is a security vulnerability—it's primarily a user-interface correctness fix.

This commit adds a safety check for the Keystone 3 hardware wallet's Zcash account setup. If the stored Zcash public key information is missing or not a valid hex string, the wallet now regenerates it. This prevents the wallet from trying to use corrupted or incomplete Zcash key data, which could cause errors or display wrong addresses. It is a defensive fix, not a clear exploit patch.

This commit changes the default backup seed phrase length for the standard firmware from 33 words to 20 words. SLIP39 seed phrases can use different word counts, and 20 words still provides substantial entropy. There is no direct evidence in the commit or supplied references that this change fixes a security vulnerability; it appears to be a product/usability change.

This commit is a user-interface cleanup for Zcash and Shamir backup flows. It removes some on-screen explanations about 20-word versus 33-word Shamir shares, reuses an existing notice window instead of a separate hint box, and makes Zcash support checks apply only to a special 'cypherpunk' build variant. There is no direct evidence of a security vulnerability being fixed.

This firmware update fixes two categories of bugs in a cryptocurrency hardware wallet's background task system and web-authentication code display. First, it adds a flag so the background task knows whether it allocated a memory buffer itself (and must free it) or was given a pointer by the caller (which it must not free). Before this fix, the task could free memory it did not own, leading to crashes or corrupted memory. Second, it hardens the web-authentication code calculation by checking whether memory allocation succeeded, clearing the private RSA key from memory after use, and correctly freeing the generated auth code string. It also removes two lines that incorrectly set freed pointers to NULL inside a cleanup function. The changes are defensive and reduce the risk of memory corruption and sensitive key material lingering in RAM, but the commit message frames them as generic fixes rather than as a security advisory.

This commit fixes several bugs in the Zcash wallet setup code for a hardware wallet. Previously, the code could ignore errors when setting up Zcash data, leak sensitive seed material in memory, use the wrong error variable, and try to decrypt a missing encrypted key. These are reliability and security hygiene issues rather than a single obvious remote exploit, but they could let a device finish account creation or login even though Zcash keys were not set up correctly, and could leave secret seed bytes in memory longer than intended.

This commit fixes a user-interface bug in the Keystone 3 hardware wallet firmware. A screen that lets users pick options from checkboxes could crash or behave incorrectly if the user tapped on a label or other non-checkbox element inside the same area. The fix adds a simple safety check so the code only reacts when a real checkbox is tapped. It is a defensive hardening change rather than a clear exploit, but in a wallet firmware any UI crash during seed-phrase or share creation could be security-relevant because it might interrupt a sensitive backup workflow.

This commit changes the default Shamir backup share length from 20 words to 33 words and adds on-screen explanations about which cryptocurrencies each option supports. It is a usability and compatibility improvement, not a security fix or vulnerability. The code also tightens a few display routines so the word count is shown correctly regardless of the selected value.

This commit updates automated test code for Zcash AES encryption so the tests use a realistic seed instead of an all-zeros seed. The all-zeros seed was recently rejected by a new safety check, causing the tests to fail. The change only affects unit tests and does not alter the actual wallet firmware behavior.

This commit changes how the Keystone hardware wallet enables Zcash for SLIP 39 wallets. Previously, Zcash was completely disabled for all SLIP 39 wallets. Now it is allowed when the SLIP 39 shares are 33 words long (256-bit entropy), but still disabled for 20-word shares (128-bit entropy). The change is driven by a cryptographic requirement: Zcash's security analysis assumes the wallet seed has at least 256 bits of entropy. The patch also fixes a small UI bug where the 'manage' option for Zcash was missing entirely for non-BIP39 mnemonics, instead of being shown as disabled.

This commit fixes a small but meaningful bug in the Keystone 3 hardware wallet's account information output. Previously, when showing details for Monero (XMR), the 'manage' field was completely left out if the wallet's mnemonic type was not BIP 39. Now it is always included and set to false in that case. The change makes the JSON response predictable and consistent, which can help companion apps or users avoid misinterpreting whether the coin can be managed. It is a defensive fix rather than an obvious exploit, but omitting a boolean field could lead a connected app to make unsafe assumptions.

This commit is a straightforward build fix for a firmware configuration file. It adds conditional preprocessor definitions so that different product build variants (Web3, BTC-only, Cypherpunk) each define a required constant, LEGACY_USB_PAD_LEN, with values of either 1 or 2. Without this change, some build configurations would fail because the constant was missing. There is no security-relevant change in behavior visible in the diff.

This commit is a visual layout fix for the Bitcoin multi-signature transaction screen. It changes how a 'signing status' box is positioned so it appears below the previous element instead of always starting at the top-left corner. There is no security-relevant change.

This is a one-line build fix that changes a default padding length constant from 1 to 2 in a legacy USB web-update feature. There is no indication of a security problem, and the change itself does not introduce or fix any vulnerability visible in the diff.

This commit fixes a simple UI bug in the Avalanche (AVAX) transaction review screen. The code was accidentally passing the recipient's address length where the sender's address length should go, which could cause the sender's address to be displayed incorrectly or truncated on the hardware wallet screen. It does not appear to affect transaction signing logic or funds security.

This commit only updates the project's changelog documents (in English and Chinese) to describe features and improvements included in firmware version 2.4.2. No source code, configuration, or executable files were changed. There is no security-relevant code modification to review.

This commit fixes a missing security check in the Zcash PCZT (Partially Created Zcash Transaction) verifier for the Keystone 3 hardware wallet. Previously, when a transaction output could be decrypted with an internal outgoing viewing key (a key meant for change/internal addresses), the code did not verify that the output actually belonged to the wallet. This could allow a maliciously crafted transaction to trick the wallet into accepting an external output as if it were internal/change. The patch now checks that any output recoverable with an internal OVK is actually a wallet-owned Orchard address, and also considers the transparent internal OVK. The commit message is just 'fix: zcash checks' and does not disclose this as a security issue.

This commit only changes a single version number in a header file, bumping the firmware build version from 2.4.0 to 2.4.2. There are no code changes, no bug fixes, and no security-related content in the diff.

This commit changes how the Keystone hardware wallet reports its firmware version when pairing with Zcash wallets. Previously it used a function that returned a display-formatted version string (with a flavor suffix). Now it formats the raw major/minor/build numbers directly. The goal is to make the pairing QR code's version string match the version bytes stamped by the PCZT signer, so wallets can use one consistent minimum-version check. There is no direct security vulnerability in the diff itself; it is a compatibility/consistency fix.

This commit changes several Bitcoin-related user-interface labels from translated text to fixed English strings. It removes translation entries for technical terms like 'Outpoint', 'Input Reference', 'Unknown', 'Input Ref', and 'Sighash' so they always display in English regardless of the user's language setting. This is a localization/usability fix, not a security patch.

This commit is a user-interface styling fix. It adds a more compact QR-code popup layout, switches one Bitcoin screen to use that compact layout, tweaks a label font style, and comments out a simulator-only macro. There is no indication of any security bug being fixed.

This commit fixes how Keystone 3 hardware wallets parse Avalanche (AVAX) transactions. Previously, the code only handled a single derivation path and a single sender address. The update supports multiple input addresses/paths, correctly matches displayed 'from' addresses to their derivation paths, and fixes a UI layout and memory cleanup issue. The main security risk is that a malformed or multi-input AVAX transaction could have been displayed misleadingly, potentially tricking a user into approving a transaction they did not intend to sign.