CommitWatch RSS
BB
← Watched projectsVendor accountability

BitBox

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Low 39 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

rust: initialize C output buffers

This commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…

Undefined behavior at C/Rust FFI due to uninitialized buffers being treated as Rust slicesPotential optimizer-dependent behavior from violating Rust slice initialization rulesHardening of cryptographic output paths (SHA-256, HMAC-SHA256, HMAC-SHA512)
511018eaby benma's agent+52−2713 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 70 AI analysisMessage 66 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Validate mounted FAT geometry

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bo…

Fixes integer-wrap / geometry confusion in FAT mount logicAdds explicit post-mount validation of filesystem metadataPrevents data area from landing inside attacker-controlled FAT sectors
01c017d6by Marko Bencun+21−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 0 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: update stage1 binaries to v1.2.2

This commit simply swaps in newer pre-built bootloader stage1 binary files (version 1.2.2 replacing 1.2.1) for four BitBox02 hardware variants and updates the corresponding checksum list. The actual code inside the new binary files is not …

5940a800by Marko Bencun+8−86 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader/stage1: fix erase handling for partially erased blocks

This update fixes the BitBox02 bootloader's firmware-erase routine. Previously, when erasing leftover padding after a firmware update, the bootloader started erasing at the exact page where the firmware ended. Because flash memory can only…

Bootloader firmware erase routine could erase a flash block containing both firmware and paddingFix aligns erase start to erase-block boundary and re-checks erased state before erasingChangelog describes the change as a fix for 'partially erased flash blocks'
b31206a8by Marko Bencun+23−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: add stage0/stage1 production binaries

This commit adds production bootloader upgrade files for the BitBox02 hardware wallet and updates build scripts to use them. It is a routine asset-management change: replacing placeholder development hashes with real signed production bina…

8db4b0dcby Marko Bencun+26−1720 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 83 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: keep dev stage1 unsigned

This commit fixes a build script used only for development/testing versions of the BitBox02 bootloader upgrade. It makes the development-stage1 bootloader images unsigned again, while keeping production images fully signature-verified. The…

Signature verification relaxed only for development buildsProduction payload validation still requires signaturesDevelopment stage0 already skipped stage1 signature verification per commit message
476b90e3by Marko Bencun+9−69 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 23 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

security improvements

This BitBox02 firmware update is a broad security patch that fixes several independent bugs: it prevents a maliciously oversized USB report from overflowing memory, stops a corrupted Bluetooth pairing database from being read or written wi…

Bounds check added to USB HID Set Report input lengthBLE bond DB length validation hardened against negative and oversized valuesBootloader firmware image size limit relaxed to intended maximum
cbb40634by Marko Bencun+1117−25021 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 60 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: allow full sized images

This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fi…

Off-by-one input validation in firmware-update pathBootloader change affecting firmware chunk count acceptanceCHANGELOG labels the change as a bugfix for full-sized firmware upgrades
f60b93ccby Marko Bencun+5−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Add bootloader update

This is a large firmware commit that adds a new two-stage bootloader update mechanism for the BitBox02 hardware wallet. It replaces the old single bootloader with a small, fixed 'stage0' plus a separately signed 'stage1', and ships a speci…

Bootloader architecture changed from monolithic to two-stage (stage0 + signed stage1).Firmware signature hash now includes a 16-bit product_id, binding firmware to product variant.Root public keys were rotated/replaced with a single set across all products.
3f1f3172by Marko Bencun+5003−52379 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Bump Rust toolchain to 1.96

This commit is a routine maintenance update for the BitBox02 hardware wallet firmware. It upgrades the pinned Rust compiler toolchain from an older version to Rust 1.96.0, updates the project's Docker build container and related developer …

Routine toolchain and dependency upgradeVendored libc updated across many platform bindingsNo first-party security-relevant code changes
55e3dd30by Niklas Dusenlund+14839−13798360 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: reduce snprintf

This commit removes the use of the standard snprintf formatting function from the BitBox02 bootloader's developer menu and replaces it with a small, fixed-format helper. The main goal is to reduce the bootloader's binary size and make the …

Removes snprintf/printf usage from bootloader code, reducing binary bloat and eliminating a complex formatting library from a privileged execution contextExtends automated CI check to detect stdio/Rust formatting symbols in regular development and production bootloader outputs, not just production buildsAdds unit test coverage for the new fixed-format helper
2fb9d57fby Marko Bencun+59−106 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 63 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: avoid snprintf formatting

This commit removes the use of standard string-formatting functions (like snprintf and Rust's format!) from the bootloader and related low-level code, replacing them with smaller, fixed-size string builders. The stated goal is to reduce bi…

Removal of stdio formatting (snprintf family) from bootloader codeRemoval of Rust format!/write! formatting from bootloader-linked codeAddition of CI gate rejecting stdio and Rust formatting symbols in production bootloader ELFs
33434fa9by Marko Bencun+298−6314 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: extract formatting helpers

This commit is a simple code cleanup: it moves a handful of string-formatting helpers (for pairing codes, progress percentages, hash display, timers, and unknown-command messages) out of the main bootloader file into a new dedicated file, …

1a1de3b5by Marko Bencun+147−126 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: render messages directly

This commit removes a 100-character stack buffer and passes bootloader messages straight to the screen-drawing function. The old code used snprintf to copy the message into a fixed-size buffer, which could silently truncate very long strin…

Removal of fixed-size stack buffer in bootloader display pathElimination of snprintf with potentially attacker-influenced format string argumentBootloader code touched, which is a security-sensitive component
c0bc7b92by Marko Bencun+1−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Use integer progress fractions

This commit replaces floating-point progress calculations with integer math to save firmware space. It removes the use of f32 arithmetic for progress bars in Bitcoin transaction signing and Bluetooth firmware upgrades. There is no direct s…

Removal of floating-point arithmetic reduces attack surface related to soft-float emulation bugsNew integer fraction API introduces denominator-non-zero and numerator-bound assumptionsCall sites use checked arithmetic to prevent overflow in progress computation
17c4947fby Marko Bencun+52−3712 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 80 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Enable scope C LTO for firmware

This commit changes the build system to enable Link-Time Optimization (LTO), a compiler technique that shrinks the final firmware size. It also adds safeguards to keep the stack protector security feature working under LTO and deliberately…

Build-system change enabling LTO with explicit stack-protector symbol retentionDeliberate exclusion of bootloader, factory-setup, ASF4, samd51a-ds, and embedded-swd from LTO due to audit complexityToolchain switch to LTO-aware archive utilities to avoid invalid tiny images from missing live objects
0b102fb7by Marko Bencun+29−36 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 95 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

da14531: restore BLE UART backpressure

This update fixes a crash in the BitBox02 hardware wallet when a user lists many backups over a Bluetooth connection. Previously, the device could run out of temporary buffer space while sending a large response, causing it to panic and st…

Denial-of-service via buffer overflow/panic on Bluetooth pathMissing backpressure leading to unbounded queue growth and crashAtomic all-or-nothing enqueue to preserve serial frame boundaries
3201c5d2by Marko Bencun+87−37 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 35 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

securechip: port attestation sign

This commit is a code refactoring that moves the device attestation signing function from C code into Rust code. It converts the function to be asynchronous (async/await) and rewrites the parsing of the secure chip's DER-encoded signature …

Removal of C synchronous secure chip signing wrapperAddition of async Rust secure chip ECDSA signing operationRelocation of DER signature parsing from C-API Rust crate into securechip crate
2bccdebfby Marko Bencun+180−14525 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Format generated protobufs explicitly

This commit is purely a code-style and build-maintenance change. It makes the Rust code generated from protocol-buffer definitions be formatted by rustfmt automatically and included in style checks. No security-sensitive behavior is change…

f22f12cdby Niklas Dusenlund+36−1603 files
No security note in commit
Open full analysis →Source commit ↗