Keystone 3 firmware

This commit cleans up two places where TON (The Open Network) checksums were being converted to hex strings by hand-written loops, replacing them with a single helper function `ByteArrayToHexStr`. It also adds a debug print statement showing whether the TON and BIP39 mnemonic comparisons succeeded during the 'forget TON' flow. The title 'fix ton forget' suggests the change is meant to fix a bug in the process of forgetting/removing a TON wallet, but the diff itself does not show an obvious security vulnerability or a clear behavioral fix beyond code simplification and extra logging.

This commit replaces a custom secure-wipe function with a standard one in code that handles secret key material during password-based key derivation. The change is likely a defensive hardening fix, but the diff alone does not prove an exploitable vulnerability existed.

This firmware update fixes a bug in how the Keystone 3 hardware wallet handles TON (The Open Network) wallet setup. The changes remove several safety checks and replace safer string/buffer functions with less safe ones, while also restructuring how TON entropy and seed generation errors are handled. The commit title says it fixes a TON wallet bug, but the diff itself mostly removes defensive coding patterns rather than adding them. Without more context, it is unclear whether the change fully resolves the underlying issue or introduces new risks.

This commit removes a function that filled public key info for all cryptocurrency chains and adds a null-password check in the RSA key-reading path. The stated goal is to fix a crash. The crash likely happened because RSA key generation/reading ran while the password cache was empty, causing GetAccountSeed to dereference a null password. Removing the broad chain-info filler may also prevent crashes from partially initialized state during wallet setup or account switching.

This commit fixes a mismatch in how the firmware stores a recovery phrase (mnemonic) in memory. Previously, the code allocated memory based on the actual phrase length but then copied the phrase using a fixed maximum size. The change makes both steps use the same, correct length. This is a defensive fix that prevents potential memory corruption or undefined behavior when handling the secret recovery phrase.

This commit reviews and hardens the fingerprint sensor subsystem in the Keystone 3 hardware wallet firmware. It removes a custom CRC implementation and several hard-coded encryption keys used for fingerprint communication, replacing them with zero-initialized keys that are later populated at runtime. It also refactors command timeout/retry logic and removes a direct fingerprint sensor system-reset command. The changes reduce the risk that an attacker could exploit predictable keys or a weak checksum to interfere with fingerprint enrollment, recognition, or deletion, but the patch is only partial: the code still calls a removed CRC function in one place and the overall security impact depends on how runtime keys are generated.

This commit is a security-focused code review and hardening pass on account and secret handling in the Keystone 3 hardware wallet firmware. It replaces unsafe string and memory functions (strcpy, sprintf, memcpy) with safer bounded versions, removes debug printf leaks of sensitive data, fixes a bug where a new-password cache overwrote the password cache, adds compile-time guards against shipping test keys in production, and hardens JSON parsing against malformed flash data. These are defensive improvements that reduce the risk of buffer overflows, information leaks, and accidental weakening of secure-element protections.

This commit is a routine code cleanup in the Ethereum module of the Keystone 3 firmware. It renames a function for clarity, changes some function signatures to accept data slices instead of owned vectors for efficiency, and replaces a few direct `.unwrap()` calls with safer `.unwrap_or_default()` handling. There is no indication this fixes a security vulnerability.

This commit is a code-review hardening pass for the Cardano wallet module in the Keystone 3 firmware. It replaces many Rust `.unwrap()` calls with proper error handling, adds bounds checks for derivation paths and public keys, zeroizes sensitive seed/entropy buffers after use, and fixes a seed-length bug for BIP39 vs SLIP39 accounts. Most changes reduce the chance that malformed transaction data or missing key material causes a crash or leaks secrets, but the commit is broad and includes many test additions, so it is better characterized as defensive cleanup than a single fixed vulnerability.

This commit is a code review and cleanup of the Cosmos cryptocurrency support in the Keystone 3 hardware wallet firmware. It fixes several small but real issues: it corrects a buffer-size mismatch when copying passwords/passphrases into memory, avoids unnecessary cloning of transaction data, adds zeroing of the seed buffer after signing, and fixes memory leaks and repeated JSON parsing in the Cosmos UI code. There is no clear evidence of an exploitable remote attack, but the changes reduce the chance of memory corruption and secret leakage.

This commit is mostly a routine cleanup and test-addition patch for Zcash support in the Keystone 3 firmware. It adds many Rust unit tests for error handling, PCZT parsing, and data structures, fixes a Cardano test that had an empty expected value, removes a stray blank line, and refactors the Zcash signing UI flow to use a shared internal helper. There is no direct evidence in the diff of a security vulnerability being fixed.

This commit updates the Rust zeroize library from version 1.8.1 to 1.8.2 in a cryptocurrency hardware wallet firmware project. The zeroize library is used to securely erase sensitive data like private keys from memory after use. The commit also adds a large Chinese-language technical specification document for Sui blockchain support. The actual code change is a routine dependency patch with no direct exploit visible in the diff, but the commit message claims it is for 'improved security features.'

This commit removes an unused C language label named 'out:' from a function in the RSA cryptography file. The label appears to have been leftover code with no actual security effect, because nothing in the function jumps to it and the cleanup logic runs unconditionally anyway. There is no indication this change fixes or introduces a security problem.

This commit is a code review and cleanup pass for the Avalanche (AVAX) app in the Keystone 3 hardware wallet firmware. It fixes typos in transaction type names, adds a few length checks before reading transaction bytes, replaces direct low-level signing with a safer helper, and consolidates signing code so AVAX, IOTA, and SUI share the same secure path. Most changes are defensive hardening and refactoring rather than a single obvious critical bug fix.

This commit refactors the Sui blockchain support in the Keystone 3 hardware wallet firmware. The main security-relevant changes are: replacing several panic-prone `.unwrap()` calls with proper error handling, adding checks for empty derivation paths that previously could have caused crashes or undefined behavior, validating public key length during address generation, and ensuring the wallet's seed is wiped from memory (zeroized) more reliably after signing. The commit also fixes a memory-freeing bug in the user interface where the wrong type of result could be freed depending on whether a normal transaction or a 'sign message hash' request was being handled.

This commit is a defensive security hardening patch for the Keystone 3 hardware wallet firmware. It adds the `zeroize` Rust crate and explicitly clears sensitive memory buffers (mnemonics, seeds, passwords, RSA seeds, entropy, SLIP39 shares) after use. It also replaces many unsafe `strcpy`/`strcat`/`memcpy` calls with safer bounded versions, removes several `unwrap()` panic points in Rust FFI code, and tightens error handling in wallet creation and recovery flows. The changes reduce the risk that secret material remains in RAM after operations, and reduce the chance that malformed input crashes the device or leaks secrets through panic paths.

This commit hardens how a hardware wallet (Keystone 3) handles sensitive RSA prime numbers used for Arweave transactions. It adds explicit length checks on seeds and prime inputs, switches to a safer memory-clearing helper (`zeroize` in Rust, `memset_s`/`CLEAR_ARRAY` in C), and removes an unused RSA helper that could have accepted arbitrary-length secrets. The changes reduce the risk of crashes, memory leaks of secret material, and misuse of malformed keys, but the commit itself is a defensive refactor rather than a fix for a confirmed active exploit.

This commit only updates unit tests for the Avalanche transaction parser. It swaps test blockchain IDs from mainnet to testnet values, removes debug print statements, fixes an import order warning, and replaces placeholder assertions with real ones. There is no change to production code that handles user funds or device security.

This is a large cleanup commit titled 'chore: fix warning'. It removes compiler warnings across many Rust modules by deleting unused imports, switching to modern Rust syntax, and fixing minor style issues. The most notable functional change is in the Monero code, where randomness for key-image generation and encryption now comes from the operating system's secure random source (OsRng) instead of a deterministic seed derived from the request data. That change is a security improvement, not a vulnerability. There is no clear evidence in the commit of an exploitable security bug.

This commit is a routine cleanup of Rust compiler warnings (Clippy lints). It removes unused imports, rewrites idiomatically cleaner code, fixes variable naming, and updates a few function signatures. There is no indication it fixes a security vulnerability or changes security-critical behavior.

This commit is purely a code cleanup: it runs the Rust formatter (fmt) and applies Clippy lint suggestions. The changes are cosmetic—reformatting lines, reordering imports, removing unused imports, and adding 'unsafe' markers to functions that already contained unsafe operations. There is no functional change to how the firmware handles keys, transactions, or user data, and no security vulnerability is introduced or fixed.

This commit adds one line that turns off a 'quick access' toggle for the passphrase feature whenever the passphrase text is cleared. Without this fix, the toggle could stay enabled unexpectedly, potentially causing the device to remember or expose passphrase-related settings in a state the user did not intend. The change is defensive and improves safety, but the diff alone does not prove an exploitable vulnerability exists.

This commit adds code that clears the optional passphrase text from the screen and resets its visibility to hidden (password mode) whenever the user navigates back from passphrase entry during wallet creation, import, or settings. It also refactors how the 'show/hide' eye icon is controlled. The change looks like a cleanup fix to prevent a sensitive passphrase from lingering on screen or staying visible after a user leaves the page, which could reduce the risk of shoulder-surfing or accidental disclosure.

This is a large code-cleanup commit titled 'fix: run fmt and rust fix'. It applies Rust formatting, clippy lint fixes, and removes unstable nightly feature flags across many Rust files in the Keystone 3 firmware. The changes are mostly stylistic or idiomatic (e.g., replacing manual loops with while-let, using OsRng instead of deterministic seeds for Monero bulletproofs/CLSAG signatures, changing pointer-safety annotations to unsafe, and removing unused imports). There is no explicit vendor statement that this fixes a security vulnerability, and the diff does not show a clear, exploitable bug fix. However, the Monero RNG change is a meaningful functional change that could affect cryptographic security if the prior deterministic seeding was flawed, and the broad unsafe FFI annotation changes could hide or expose memory-safety issues. Overall the commit appears to be a routine refactor/tooling fix rather than a targeted security patch.