KS
← All projectsKeystone

Keystone 3 firmware

Open-source device firmware for Keystone 3 hardware wallets.

BitcoinHardware walletsNormal
Repository coverage

553 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

119security candidates294second-pass queue551AI analyses
9commits · 30 days
37commits · 60 days
279commits · 180 days
504commits · 365 days
Backfill bands
Aug 5 → Feb 6260 seen14 candidatesComplete
Feb 6 → Jun 6117 seen7 candidatesComplete
Jun 6 → Jul 639 seen4 candidatesComplete
Jul 6 → Aug 5115 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

42/100 average clarity
35Strong · 80–100
72Adequate · 60–79
211Thin · 40–59
235Opaque · 0–39
39security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
soralit11634116248
Adam Tucker931193263
aaron30430248
Soralit959154
ww351268717652176026
willwang15215025
John Boyd626088
github-actions[bot]323076
Aaron Chen222068
Qkin-Keystone26126036
qkin12112050
Greg Pfeil414071
Analysis record

Published AI watches

Last scanned 5 minutes ago

Low 42 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2293 from KeystoneHQ/merge/v3.1.0

This is a large firmware release merge (v3.1.0) for the Keystone 3 hardware wallet. The visible changes are mostly a major FreeRTOS kernel upgrade (from v10.x to v11.3.0), build-system improvements, and user-facing feature tweaks such as b…

FreeRTOS kernel major version upgrade (10.x -> 11.3.0) with MPU hardeningSwitch from ARM_CM4F non-MPU port to ARM_CM4_MPU portNew MPU configuration flags: configTOTAL_MPU_REGIONS=8, configENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1, configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0
0c0ae467by stone+59616−26981300 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 48 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci (#2292)

This commit only updates a Git submodule pointer in a release-tracking file. The actual code change is a one-line pointer update from one commit hash to another in a file named 'keystone3-firmware-release'. There is no visible security-rel…

90d1c789by Soralit+1−11 file
No security note in commit
Informational 15 AI analysisMessage 40 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

chore: update ci

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. No source code, build scripts, CI configuration, or security-related files are changed in the visible diff. There is no evidence…

a7f6db29by Soralit+1−11 file
No security note in commit
Moderate 58 AI analysisMessage 28 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

release 3.1.0

This is a large firmware release commit (version 3.1.0) for the Keystone 3 hardware wallet. The most significant change visible in the diff is a major upgrade of the FreeRTOS real-time operating system kernel from version 10.x to 11.3.0, c…

FreeRTOS major version upgrade (10.x → 11.3.0) with MPU port enabledNew MPU sandbox task/runtime/validator files addedconfigENFORCE_SYSTEM_CALLS_FROM_KERNEL_ONLY=1 and configALLOW_UNPRIVILEGED_CRITICAL_SECTIONS=0 set
2b007a29by Soralit+59615−26980300 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.8 (#2291)

This commit is a routine version-bump merge for release v3.0.8. It only updates changelogs, a Git submodule pointer, and a build version number. There is no code change visible in the diff and nothing that suggests a security fix or vulner…

b5e8f9fcby github-actions[bot]+18−24 files
No security note in commit
Low 47 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.6 (#2290)

This firmware update adds support for Solana's new V1 transaction format and changes how oversized or malformed transaction details are displayed. The code introduces a dedicated parser for V1 messages with strict size and structure checks…

New parser enforces hard limits on V1 message fields and rejects malformed 0x81-prefix payloads instead of falling back to message signingCompute-budget instructions in V1 are explicitly ignored to prevent fee-display spoofingUI pagination change for large transaction details reduces truncation risk
87b78ae1by github-actions[bot]+564−2812 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

pin to new release config (#2285)

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. There is no code change visible in the diff, no description of what the new release config contains, and no security-related inf…

bc01c889by Aaron Chen+1−11 file
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

update the release repo (#2282)

This commit simply updates a Git submodule pointer for the project's release repository. There is no visible code change, no description of any security issue, and no indication this is anything other than a routine release-tracking update.

3ac7e802by Aaron Chen+1−11 file
No security note in commit
Moderate 59 AI analysisMessage 76 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge release v3.0.4 (#2279)

This is a routine firmware release merge (v3.0.4) for the Keystone 3 hardware wallet. The bulk of the changes are UI tweaks, new feature support (Solana CLI, Lace Wallet), and hardening fixes found during an internal 'regular AI review'. T…

NUL-byte rejection in EIP-712 typed data parsingC-string conversion hardening against NUL bytesNull-pointer and UTF-8 validation added to UR parsing entry points
6ab436a2by github-actions[bot]+4960−548845 files
No security note in commit
Informational 13 AI analysisMessage 59 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Build fix (#2273)

This commit is a routine build-system and code-formatting fix. It resets cached CMake build options so each build starts from known defaults, makes cbindgen header-generation failures visible instead of silently ignored, runs Rust formatti…

8568a657by stone wang+8−145 files
No security note in commit
Low 44 AI analysisMessage 36 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

limit file count (#2272)

This commit adds a hard cap on how many files the device will list from its SD card when loading multi-signature Bitcoin wallet data. It also tightens up null-pointer and length checks while scanning directories. The likely goal is to prev…

Unbounded directory listing now bounded by FATFS_MAX_FILE_NUMBERNull-pointer guards added for fileName, number, and path parametersLength checks added before copying filenames into caller buffers
de6879c3by stone wang+31−146 files
No security note in commit
Low 46 AI analysisMessage 73 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2268 from KeystoneHQ/regular-review-fix

This commit tightens which old-style Bitcoin-like transactions the Keystone hardware wallet will accept. It now rejects raw protobuf Bitcoin (BTC) and Dogecoin (DOGE) legacy UTXO transactions, allowing only Bitcoin Cash (BCH), Dash (DASH),…

Deprecation of raw-protobuf Bitcoin transaction handlingRejection of unsupported legacy UTXO variants at multiple entry pointsShift from coin_code string matching to protobuf variant matching for legacy path eligibility
1c70d3d4by Soralit+134−166 files
No security note in commit
Moderate 61 AI analysisMessage 62 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: mark legacy utxo transaction as deprecated and disable btc legacy transactions

This commit disables the older, raw-protobuf signing path for Bitcoin and Dogecoin transactions in the Keystone 3 hardware wallet firmware. It keeps the legacy path active only for Bitcoin Cash (BCH), Dash (DASH), and Litecoin (LTC). The c…

Disables a legacy transaction parsing/signing code path for Bitcoin and DogecoinAdds explicit rejection checks before raw transaction parsing, checking, signing, and view routingSwitches discriminator from coin_code string to protobuf transaction variant to prevent spoofing
1fcd2346by Soralit+134−166 files
No security note in commit
Moderate 63 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2264 from KeystoneHQ/regular-review-fix

This firmware update is a routine 'regular review fix' that hardens how the Keystone 3 hardware wallet checks and displays several cryptocurrency transactions before signing. The most important security changes are: (1) the sign button is …

Sign slider disabled until parse success prevents premature approvalArweave DataItem tag-count mismatch now rejected in pre-checkAvalanche transaction re-validated by type in pre-check, tampered asset ID rejected
87c7e7e2by Soralit+623−20423 files
No security note in commit
Moderate 67 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2263 from KeystoneHQ/driver-optimize

This commit updates the hardware random number generator (TRNG) driver in a cryptocurrency hardware wallet firmware. It adds detection for a physical fault/attack signal from the TRNG and, if triggered, wipes the random data and aborts via…

Added TRNG fault/attack status detection (TRNG_IT_RNG0_ATTACK)Zeroization of sensitive local buffer and output buffer on TRNG failureAssertion abort on detected TRNG attack condition
a409efe0by Soralit+29−51 file
No security note in commit
Moderate 59 AI analysisMessage 18 · Opaque
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

driver optimzie

This commit updates the hardware random number generator (TRNG) driver in a cryptocurrency hardware wallet firmware. It adds detection for a physical tamper/attack signal from the TRNG chip and, if an attack is detected, wipes the random d…

New check of TRNG_IT_RNG0_ATTACK tamper/attack interrupt statusFailure path now zeroes output and local buffer before abortingAddition of ASSERT guards and secure memset_s usage
25f3d951by ww3512687+29−51 file
No security note in commit
Moderate 61 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: regular ai review fix

This firmware update for the Keystone 3 hardware wallet fixes several security and safety issues found during an internal AI-assisted review. The most important changes are: (1) the signing slider is now disabled until a transaction is ful…

Signing slider disabled until parse success prevents approval of malformed transactionsArweave DataItem tag-count mismatch rejected in pre-check before confirmation pageAvalanche transaction re-validated by type during fingerprint check
edbeae79by soralit+623−20423 files
No security note in commit
High 76 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2262 from KeystoneHQ/regular-review-fix

This firmware update fixes several security and safety issues found during a regular AI-assisted code review. The most important changes are: (1) Zcash wallet data is now encrypted with a key derived from the wallet seed and a fresh random…

Zcash UFVK encryption key changed from sha256(password) to seed-derived BIP32 keyZcash UFVK IV changed from deterministic seed-derived value to fresh TRNG-generated IV per blobZcash UFVK storage format now uses magic-prefixed blob with embedded IV and rejects legacy blobs
04d942ffby Soralit+1852−52633 files
No security note in commit
High 80 AI analysisMessage 57 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

fix: regular AI review and fix

This firmware update fixes several security and safety issues found during an internal AI-assisted review. The most important changes are: (1) Zcash wallet data was being encrypted with a key derived from the user's login password and a fi…

Zcash UFVK encryption key changed from sha256(login password) to seed-derived BIP32 keyZcash UFVK IV changed from deterministic seed-derived value to fresh TRNG-generated IV per encryptionNew 'z2' UFVK blob format stores IV with ciphertext; legacy blobs rejected/migrated
776d8832by soralit+1852−52633 files
Vendor flagged security relevance
Moderate 59 AI analysisMessage 58 · Thin
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

Merge pull request #2260 from KeystoneHQ/replace-lvgl-rand

This commit replaces the on-screen keyboard shuffle and a word-list randomizer so they use the device's true random-number generator (TRNG) instead of LVGL's weaker pseudo-random function. The change is defensive: it removes a source of pr…

Replaced pseudo-random generator with hardware TRNG in security-sensitive shuffle operationsRemoved fixed-range modulo reduction bias source (`lv_rand(0, 2048) % n`)Changed include from LVGL UI library to device TRNG driver in utility code
230abd77by Soralit+8−32 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedfont scriptsby ww3512687 · 81db0727 · Apr 14, 2026 · 13 filesMessage 18 · OpaqueInformational 15Details
Commit message · ww3512687

font scripts

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a routine regeneration of font glyph data for the device's user interface. It removes a few unused Chinese characters from the symbol lists and updates the corresponding bitmap tables and translation data. There is no indication of any security fix or vulnerability being addressed.

AI review queuedfix warningby ww3512687 · eb771ee3 · Apr 14, 2026 · 1 fileMessage 0 · OpaqueInformational 17Details
Commit message · ww3512687

fix warning

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 17/100

This is a one-line type-name correction in the Avalanche (AVAX) transaction display code. The developer changed a variable declaration from a TON (Telegram Open Network) transaction result type to the correct AVAX transaction result type. It appears to fix only a compiler warning and has no visible functional effect, because the underlying pointer types are likely identical in memory layout.

AI review queuedfix merge conflict bugby Qkin-Keystone · 333badc3 · Apr 14, 2026 · 1 fileMessage 28 · OpaqueLow 25Details
Commit message · Qkin-Keystone

fix merge conflict bug

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 25/100

This commit fixes a merge conflict in a firmware file for the Keystone 3 hardware wallet. The change adds a missing memory cleanup function (FreeTrxMemory) and restores a missing user-interface entry for TRX swap transactions. Without the cleanup function, memory used during transaction review might not be released, which could contribute to memory leaks or instability over time. The missing UI entry could have caused the TRX swap screen to be absent or misaligned. There is no direct evidence in the commit of an exploitable security vulnerability such as theft of funds or bypass of confirmation.

AI review queuedadd expiration for warpped tron instanceby Qkin-Keystone · 3f277a90 · Apr 14, 2026 · 1 fileMessage 45 · ThinInformational 11Details
Commit message · Qkin-Keystone

add expiration for warpped tron instance

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 11/100

This commit adds a new 'expiration' field to a Tron transaction data structure used inside the Keystone hardware wallet firmware. The change only initializes the field to an empty string in a few places and does not, by itself, appear to fix or introduce any security vulnerability. It looks like a routine data-structure update to support an expiration value that may be shown or used elsewhere.

Lower-priorityfix TRX swap to asset mapping bugby Qkin-Keystone · 82866b9a · Apr 14, 2026 · 1 fileMessage 45 · ThinLow 35Details
Commit message · Qkin-Keystone

fix TRX swap to asset mapping bug

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Low 35/100

This commit fixes a bug in how the Keystone 3 hardware wallet classifies certain Tron (TRX) transactions. Previously, only memos starting with '=:' were recognized as swap transactions. Now memos beginning with 'SWAP:' (case-insensitive) are also recognized as swaps. This is a UI/flow correction rather than a cryptographic fix, but misclassification could cause a user to review a swap transaction on the wrong screen, potentially hiding important swap-specific warnings or safety checks.

AI review queuedfix pr reviewby Qkin-Keystone · 31e9649f · Apr 14, 2026 · 2 filesMessage 28 · OpaqueInformational 14Details
Commit message · Qkin-Keystone

fix pr review

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 14/100

This tiny code-quality patch addresses two minor issues found during a pull-request review: one removes an unnecessary `.clone()` call in Tron transaction handling, and the other adds a missing memory-field cleanup for a new Ethereum/Swapkit display field. Neither change is clearly a security fix, but the missing `free_str_ptr!(self.raw_value)` could in theory leave a small amount of heap memory unreleased when a struct is destroyed.

AI review queuedfix TRX swap to assetby Qkin-Keystone · a48b77e6 · Apr 14, 2026 · 3 filesMessage 38 · OpaqueLow 34Details
Commit message · Qkin-Keystone

fix TRX swap to asset

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 34/100

This commit changes how a Keystone hardware wallet displays the destination asset for TRON (TRX) swap transactions. It adds a mapping from short/raw asset codes (like 'b' for BTC, 'e' for ETH) to human-readable names, normalizes case, strips suffixes, and handles chain/asset separators. The change is a UI/display fix for swap transaction memos, not a core cryptographic or signing change. There is no explicit security claim in the commit or supplied references.

AI review queuedupdate code formatby Qkin-Keystone · cca2aca6 · Apr 14, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Qkin-Keystone

update code format

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only reformats existing source code. It changes line breaks and indentation in a single Rust file so that a long expression and an if-statement are split across multiple lines. No logic, behavior, or security checks were changed.

AI review queuedfix code reviewby Qkin-Keystone · c2fdab1b · Apr 14, 2026 · 2 filesMessage 28 · OpaqueLow 37Details
Commit message · Qkin-Keystone

fix code review

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 37/100

This commit moves a memory-freeing operation from one cryptocurrency display structure (Ethereum Swapkit) to another (Tron). It appears to fix a code review finding about a string pointer being freed in the wrong place, which could otherwise lead to a use-after-free or double-free memory bug. The actual security impact depends on whether the affected field is heap-allocated and how the structures are used after freeing.

AI review queuedupdate tron swapkit memo uiby Qkin-Keystone · d063c974 · Apr 14, 2026 · 13 filesMessage 45 · ThinLow 27Details
Commit message · Qkin-Keystone

update tron swapkit memo ui

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This commit adds a new on-screen display for Tron cryptocurrency swaps that use a memo starting with '=:' (called 'SwapKit' style). It shows the user extra details such as the destination asset, destination address, raw amount, memo, and expiration time before signing. The change is mostly a UI feature, but it also parses and displays user-controlled memo text, which could be abused to mislead the user if the memo contains crafted text. There is no evidence in the commit that this is a security fix or that the vendor called it a vulnerability.

AI review queuedtest: verify memo in raw_data and fix formattingby qkin · 2f90d5ff · Apr 14, 2026 · 1 fileMessage 67 · AdequateInformational 15Details
Commit message · qkin

test: verify memo in raw_data and fix formatting

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new test assertion to existing Rust test code. It checks that the transaction memo matches the raw_data.data field in a Tron transaction test. There is no change to production code, no bug fix, and no security-relevant behavior change.

AI review queued update code formatby qkin · dc988b09 · Apr 14, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · qkin

update code format

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only reformats a single Rust test file by splitting a long assert_eq! line into multiple lines. It does not change any executable code, logic, or security behavior.

AI review queued fix:add memo for tron swap txby qkin · 468eff30 · Apr 14, 2026 · 1 fileMessage 45 · ThinInformational 11Details
Commit message · qkin

fix:add memo for tron swap tx

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 11/100

This commit adds a new test case for parsing TRON swap transactions that include a memo field. It does not change any production code; it only verifies that an existing parser can correctly extract a memo from a specific transaction payload. There is no indication of a security fix or vulnerability.

Lower-priority update tron parse raw messageby Qkin-Keystone · e749ef3b · Apr 14, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Qkin-Keystone

update tron parse raw message

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes the user-facing warning text shown when a TRON raw message cannot be parsed. It is a wording update with no functional or security change.

Security candidatechore: update ciby soralit · 72436c1c · Apr 13, 2026 · 5 filesMessage 40 · ThinInformational 15Details
Commit message · soralit

chore: update ci

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a routine build-system cleanup. It moves a Sui blockchain dependency from being declared in one specific app file to being declared once at the workspace level, and then references it from the app and C-binding crates. It also reformats some Zcash feature flags onto single lines. There is no visible security fix or vulnerability being patched.

AI review queuedfeat: upgrade sui sdkby soralit · 8c9aba41 · Apr 13, 2026 · 33 filesMessage 40 · ThinLow 35Details
Commit message · soralit

feat: upgrade sui sdk

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Low 35/100

This commit is titled 'upgrade sui sdk' and mostly swaps the Sui library dependency to a newer, slimmer package, updates the Rust compiler version used across build scripts, and adjusts code to match the new library's types. There is one notable code change in the Sui request-checking function: it now immediately returns a success result and skips all actual validation. That looks like a temporary debugging change left in the commit, but it could allow an unverified Sui transaction to be approved. The commit does not describe itself as a security fix, and there is no disclosed vulnerability or researcher attribution.

AI review queuedfeat(zcash): pass firmware version in ZcashAccounts pairing QRby Adam Tucker · 7c477f86 · Apr 12, 2026 · 3 filesMessage 85 · StrongInformational 18Details
Commit message · Adam Tucker

feat(zcash): pass firmware version in ZcashAccounts pairing QR

Pass GetSoftWareVersionNumber() through the Zcash connect wallet
flow so the ZcashAccounts UR includes the device firmware version.
This mirrors what other chains (MetaMask, OKX, etc.) already do
via MultiAccounts.deviceVersion.

Requires the updated ur-registry crate with the device_version
field on ZcashAccounts (valargroup/keystone-sdk-rust@adam/zcash-accounts-device-version).

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit adds the device's firmware version number to the QR code that a Keystone hardware wallet shows when pairing with Zcash wallet software. The change is informational only and matches what the wallet already does for other cryptocurrencies like MetaMask and OKX. There is no indication it fixes a security bug or introduces a security weakness.

Security candidatechore: update ciby soralit · 9a334de0 · Apr 10, 2026 · 1 fileMessage 40 · ThinInformational 10Details
Commit message · soralit

chore: update ci

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
AI analysis · Informational 10/100

This appears to be a routine CI (Continuous Integration) configuration update with no visible security relevance. Only one file was changed with a single-line addition and deletion. The actual code diff is unavailable, so no security-relevant content can be assessed.

AI review queuedfeat: add more info on bitcoin transaction parsingby soralit · 8611828f · Apr 10, 2026 · 6 filesMessage 62 · AdequateLow 35Details
Commit message · soralit

feat: add more info on bitcoin transaction parsing

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 35/100

This commit improves the Bitcoin transaction review screen on Keystone hardware wallets. It adds clearer warnings and labels when a transaction uses unusual signature modes (SIGHASH_SINGLE or SIGHASH_NONE) or when the fee cannot be calculated exactly (for example, with ANYONE_CAN_PAY inputs). It also fixes a small display issue where line breaks in help text were shown as raw '\r\n' characters. Overall, this is a defensive user-interface improvement rather than an attack.

AI review queuedfeat: add input ref qrby soralit · c977c08e · Apr 10, 2026 · 10 filesMessage 50 · ThinInformational 18Details
Commit message · soralit

feat: add input ref qr

50/100 · ThinMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathparser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit adds a new user-interface feature for Bitcoin transactions on the Keystone 3 hardware wallet. When a transaction input only provides a 'witness UTXO' (a lightweight proof of the coin being spent), the device now shows a warning asking the user to verify the input value, and offers a QR code that links to the transaction on a public blockchain explorer (mempool.space). This is a defensive UX improvement, not an attack or vulnerability fix. It helps users spot potentially fraudulent input amounts but does not change the underlying signing logic.

AI review queuedfeat(zcash): stamp firmware version into signed PCZTsby Adam Tucker · d7106d69 · Apr 9, 2026 · 6 filesMessage 85 · StrongInformational 19Details
Commit message · Adam Tucker

feat(zcash): stamp firmware version into signed PCZTs

Every signed PCZT response now carries
global.proprietary["keystone:fw_version"] = [major, minor, build]
so wallets can detect the Keystone firmware version after scanning
the signed QR and gate features accordingly.

The firmware does not enforce any minimum version — it just reports
its own. The wallet is the authority on version policy.

- build.rs reads src/config/version.h at compile time to generate
the KEYSTONE_FW_VERSION const (no manual sync needed)
- sign_pczt stamps the version via the pczt Updater role before
the Redactor strips witness data
- Simulator-only: replace the synchronous AsyncExecute stub with a
proper FIFO queue so the cypherpunk simulator doesn't crash during
wallet onboarding
- Simulator-only: guard KbTextAreaHandler against freed objects
during LVGL group cleanup

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds a firmware version stamp to Zcash signed transaction QR codes so wallets can tell which Keystone firmware version produced the signature. It also fixes two simulator-only stability bugs: one in the async task queue and one in a keyboard text-area handler. There is no direct security vulnerability in the diff; the changes are defensive or feature additions.

AI review queuedadd sol icon in connect keystone nexusby Qkin-Keystone · 86490bcf · Apr 9, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Qkin-Keystone

add sol icon in connect keystone nexus

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply adds the Solana (SOL) coin icon to two lists of icons shown on the 'connect wallet' screen for the Keystone Nexus wallet. It is a cosmetic UI change with no security relevance.

AI review queuedadd sol nexus supportby Qkin-Keystone · a9d31cb9 · Apr 9, 2026 · 2 filesMessage 28 · OpaqueInformational 15Details
Commit message · Qkin-Keystone

add sol nexus support

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds support for two Solana (SOL) public key derivation paths when connecting the Keystone hardware wallet to compatible software wallets via the 'Keystone Connect' feature. It is a routine feature addition and does not contain any obvious security fix or vulnerability.

Security candidateton only wallet crash when update to cypherpunkby ww3512687 · 2d7f3e67 · Apr 9, 2026 · 2 filesMessage 45 · ThinLow 41Details
Commit message · ww3512687

ton only wallet crash when update to cypherpunk

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 41/100

This commit fixes a firmware crash that could occur when a wallet created with only a TON (The Open Network) mnemonic was upgraded to the 'cypherpunk' firmware version. The crash happened because two code paths that handle public key/account setup did not recognize TON-only wallets and tried to perform operations that are invalid for them. The fix adds explicit TON checks so those paths return early instead of crashing.

AI review queuedupdate rust code formatby Qkin-Keystone · a53b1778 · Apr 9, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Qkin-Keystone

update rust code format

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only reformats Rust source code. It moves a comment onto its own line and adjusts blank lines. No program logic, calculations, or security behavior changed.