Keystone 3 firmware

This commit only changes one line in a Chinese-language changelog, correcting the heading 'Bug Fixes' to 'Bug 修复' (Chinese for 'Bug Fixes'). No code, configuration, or documentation with security implications was modified.

This commit only edits the formatting and wording of a product changelog. It adds blank lines and changes headings like 'BTC-ONLY' to 'BTC Only' and 'CYPHERPUNK' to 'Cypherpunk'. No code, configuration, or security-related content was changed.

This commit only adds a new version entry to the changelog files and bumps the firmware version number from 2.2.20 to 2.3.0. It does not change any executable code, cryptographic logic, or security-sensitive behavior. There is no security issue in this commit itself.

This commit is a routine maintenance change titled 'chore: optimize test and lints'. It updates code-coverage thresholds in CI workflows, adds Rust lint configuration for a nightly coverage feature, removes an obsolete nightly Rust feature flag, and adjusts some test data and test cases. There is no indication of a security fix or vulnerability being addressed.

This commit fixes a software crash in the wallet connection screen of the Keystone 3 hardware wallet firmware. The code now checks whether a selected coin/wallet type was found before continuing. Without this check, the device could crash when connecting to a wallet it does not recognize, likely causing a denial of service rather than theft of funds.

This commit only reformats two lines of Rust source code. It does not change what the code does, only how it is visually laid out. There is no security relevance.

This commit fixes how the Keystone hardware wallet handles Bitcoin 'sign message' QR codes. Previously, many malformed or unsupported message formats were reported as 'unsupported transaction,' which could mislead users. The change introduces a clearer 'Invalid Message' error and adds a new Japanese font glyph. It is primarily a user-experience and error-handling improvement, not a fix for a known exploit.

This commit fixes a Bitcoin multisig signing flow in the Keystone 3 hardware wallet firmware. Previously, when a transaction did not need a signature, the code exported the PSBT but did not properly handle the result object; when it did need a signature, it signed but skipped updating the UI status and freeing the result. The patch unifies both branches so the result is always processed and cleaned up. It also wraps some legacy Keystone transaction code in a WEB3_VERSION compile guard, likely preventing it from running on Bitcoin-only firmware builds where it could behave incorrectly.

This commit refactors how the Keystone hardware wallet exports Bitcoin account data (extended public keys) when pairing with BlueWallet and other apps. Previously BlueWallet received only three key types (Native SegWit, SegWit, Legacy). Now it uses the same function as Sparrow/Zeus/UniSat, which also includes the Taproot key type. This is a feature addition, not a vulnerability fix, and does not change how secrets are handled.

This commit changes two Zcash-related functions in the Keystone hardware wallet firmware so that the wallet seed is no longer treated as a mutable buffer and is no longer explicitly wiped (zeroized) from memory after use. The title says 'fix zcash unwrap,' suggesting the change was made to resolve a Rust panic caused by calling .unwrap() or by a mutability mismatch. Removing zeroize reduces memory cleanup of the secret seed, which could leave sensitive material in memory longer than intended. However, the diff alone does not prove an exploitable vulnerability; it may simply trade one bug for another.

This commit adds a single missing function declaration (PreparePublicKeys) in a Bitcoin UI source file. It is a straightforward build fix with no visible security relevance.

This commit is purely a code-formatting change. It only rewrites two test assertions in a Rust file so they fit on single lines instead of being split across multiple lines. No logic, behavior, or security checks were changed.

This commit changes how Cardano public keys are derived for SLIP39 wallets. It switches from a mutable, zeroed-out copy of the wallet seed to a non-mutable, non-zeroed copy. The change removes a safety feature that normally wipes the seed from memory after use, which could leave sensitive seed material in memory longer than intended. However, the commit message only says 'fix ada slip39 address' and gives no security explanation, so the exact risk is unclear from the diff alone.

This commit fixes a logic bug in the Keystone hardware wallet's SLIP39 backup phrase handling. The original code used 'OR' instead of 'AND' when checking word counts, which made the validation always fail for valid 20-word and 33-word SLIP39 phrases. This would have shown users an incorrect error notice and blocked legitimate wallet recovery or setup operations. It is a bug fix that improves reliability, but it does not appear to allow theft of funds on its own.

This commit simply removes four unused helper functions for handling JSON data from a utility file. There is no change to active behavior, no bug fix, and no security-relevant change.

This commit changes a password-length check from 'greater than' to 'greater than or equal to' the minimum allowed length. In the original code, a password exactly equal to the minimum length would trigger an assertion failure, which could crash the firmware or block wallet operations. The fix allows passwords of exactly the minimum length to be accepted. This is a correctness fix for an input-validation boundary condition, but the commit message gives no indication it was treated as a security issue by the vendor.

This commit fixes a memory-freeing mismatch in the Keystone 3 hardware wallet firmware. The code was freeing a memory block using the wrong allocator (EXT_FREE instead of SRAM_FREE). Such mismatches can corrupt memory and cause the device to crash or behave unpredictably. The commit title says 'fix crash,' but no further details are provided, and there is no independent evidence that this is exploitable for security harm rather than just a stability bug.

This commit only reformats whitespace in test code and updates one test's expected value for a contract-creation transaction's destination address from an empty '0x' to the zero address. It does not change any production code or fix a security issue.

This commit updates Ethereum signing code in a cryptocurrency hardware wallet firmware so that the secret seed (master key) is wiped from memory immediately after use. It also replaces several 'unwrap' crash points with proper error handling. The main security improvement is reducing the window where the seed sits in memory after signing, which could lower the risk of an attacker reading it from device RAM. However, the patch is partial: it only covers three Ethereum signing functions and does not appear to add zeroize to all signing paths in the firmware.

This commit is a code cleanup that removes a dedicated imToken wallet connection module and routes imToken through the existing MetaMask-style connection code. It also adds the ability to include the wallet name when generating connection data for MetaMask-compatible wallets. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit adds cleanup steps when the 'forget password' screen is closed. It now wipes a PIN buffer from memory and clears a secret cache. The change is defensive: it reduces the chance that a leftover PIN or secret remains in memory after the user leaves the password-recovery flow. The commit message does not say this fixes a specific vulnerability, and no public references were supplied.

This commit is a cleanup and hardening pass on how the Keystone 3 hardware wallet handles camera images, SD card files, and debug/test code. The most user-relevant change is that file-reading functions now refuse to load very large files from the SD card, which closes a path where an oversized file could exhaust device memory. Several debug helpers that could print sensitive file contents or cryptographic hashes over the serial port, plus a leftover firmware-copy routine, are removed. A camera preview buffer is also made safer by freeing it on re-init instead of leaking memory. The commit message is vague ('review data flow') and does not call this a security fix, so the security relevance is inferred from the code changes rather than stated by the vendor.

This commit is a code review and cleanup of Ethereum-related code in the Keystone 3 hardware wallet firmware. It adds many unit tests, fixes a typo in a function name (sign_fee_markey_tx → sign_fee_market_tx), replaces some static variables with constants, and fixes a few minor logic issues. The most user-visible change is adding a check for an SD card before trying to load external contract data, and fixing memory leaks where global pointers could be overwritten without freeing the old data. There is no clear evidence of an active security vulnerability being patched, but the memory management and contract-data-loading changes are defensive improvements.

This commit is a large code cleanup and refactoring of the wallet connection feature in the Keystone 3 firmware. It removes many duplicated Rust modules and C functions that generated QR-code sync data for specific wallets (Aptos, Solana, Sui, XBull, Keystone companion app, etc.) and replaces them with a single generic function. It also fixes some memory leaks by adding SRAM_FREE calls and removes unused/commented-out code. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a maintenance refactor.

This commit is purely a code-formatting cleanup. It reorders one import alphabetically and breaks several long lines into shorter ones. No logic, behavior, or security checks were changed.