CommitWatch RSS
BS
← Watched projectsVendor accountability

Blockstream

Bitcoin infrastructure company and maker of the Jade signing device.

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Informational 20 AI analysisMessage 65 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

fmt: fix and prevent future use of unsupported format spec "zu"

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage val…

Use of unsupported printf format specifier %zu on embedded targetPotential for malformed log/UI output due to undefined format behaviorAddition of CI guard to prevent recurrence
26042182by Jon Griffiths+21−145 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 30 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

otp: release md context on failure and clean temporary buffers

This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data w…

Resource leak fix: mbedtls_md_free() now called on prepare_md_ctx failure pathSensitive buffer zeroization: wally_bzero() added for rcnt_buf and hmacControl-flow change from macro-based early return to explicit success checks
6e2cb6b6by Mike Tolkachev+26−141 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 25 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

identity: clean temporary hash buffer

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensiti…

Sensitive memory not marked for clearing (missing SENSITIVE_PUSH/POP)Buffer holds HMAC-SHA512 output used in BIP32 hardened child key derivationPatch adds explicit sensitive-memory lifecycle management
b5c35779by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 15 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qrmode: clean temporary buffer

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for la…

Sensitive temporary buffer not cleared before fixUse of SENSITIVE_PUSH/SENSITIVE_POP memory-clearing macrosQR payload data may include private or confidential material
34f68c20by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

pinserver: retain unit private key on url change

This commit changes how Blockstream Jade handles its PIN server settings. Previously, changing the PIN server web address (URL) also wiped the device's private PIN encryption key, forcing the device to create a fresh one. The patch keeps t…

PIN private key lifecycle change: key retained on URL-only pinserver updatePublic-key change still triggers private-key erasure/regenerationDebug-clean and full reset still erase private key
ddcd93a3by Mike Tolkachev+38−324 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

add more boards and descriptions

This commit is a documentation update for the do-it-yourself (DIY) hardware section of the Blockstream Jade project. It adds descriptions and photos for additional supported circuit boards and updates image file references. There are no co…

f4fb150dby Valerio Vaccaro+65−1625 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

process: limit array sizes in sign_tx, register_multisig and sign_bip85_digests

This commit adds size limits to several message-handling functions in the Blockstream Jade hardware wallet firmware. It caps how many asset records, transaction inputs/outputs, multisig signers, and BIP85 RSA digests a single RPC message c…

Adds explicit upper bounds on attacker-controllable array sizesRejects zero-input/zero-output transactions before further processingMoves BIP85 digest count validation before memory allocation
e87f26bfby Daniel Newton+251−8114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

Update CHANGELOG.md

This commit only updates the project's CHANGELOG.md file to add release notes for version 1.0.41. It does not change any source code, build scripts, or configuration. The changelog text itself states that version 1.0.41 contains important …

Changelog describes prior security fixes in release 1.0.41Mentions external security researchers and tools (Loupe, Kvazar)References security-relevant improvements: stack protection, entropy, secure version, memory scrubbing, thread safety
dd45a7dcby Jon Griffiths+49−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

jadepy: update jadepy release

This commit simply bumps the version of a Python dependency called jade-client from 1.0.40 to 1.0.41, along with its matching cryptographic hashes and a fresh PGP signature. There is no code change visible here, and nothing in the commit m…

75eeada4by Jon Griffiths+19−192 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

consistency: fix docs/comment/script typos

This commit fixes five spelling mistakes in documentation, code comments, and a script comment. None of the changes alter program behavior or affect security.

9ea7eed3by Jon Griffiths+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

esp_lcd: vendor the esp_lcd component (ESP-IDF v5.5.4)

This commit copies the ESP-IDF 'esp_lcd' display-driver component directly into the Blockstream Jade firmware repository (a process called 'vendoring') at version 5.5.4. It adds about 8,700 lines of display-interface code for LCD panels us…

Large vendored third-party driver import (+8,718 lines, 43 files)Driver code runs in interrupt context and uses DMA, which historically carries memory-safety and cache-coherency risksNo explicit security fix or bug-fix narrative in commit title/message
d89207bfby Daniel Newton+8718−043 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 57 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: "fakeprod" prod-like development mode

This commit adds an official developer-only 'fakeprod' build mode for Blockstream Jade hardware wallets. It deliberately weakens several security settings (single signature, committed private keys, readable flash-encryption key, enabled JT…

In-tree private keys committed to repository (tools/fakeprod_v2.pem, tools/fakeprod_attest.pem)Secure boot minimum signatures reduced from 2 to 1Flash encryption set to DEVELOPMENT mode with key readable
cecedc76by Daniel Newton+350−59 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

urldecode: add validation for URL encoding

This commit hardens a URL-decoding helper in Blockstream Jade's firmware. It adds validation so malformed percent-encoding, embedded null bytes, control characters, and non-ASCII bytes are rejected instead of being silently decoded. A new …

Input validation added for percent-encoded sequencesRejection of embedded NUL bytes and control characters in decoded outputRejection of non-ASCII decoded bytes (>=0x80 and DEL 0x7f)
dd0d699dby Mike Tolkachev+100−272 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 73 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qr: split datastream data into its own allocation, reorder alloc/free calls

This change rewrites how a small QR-code scanning library allocates memory. Instead of one big 16 KB block, it now uses two separate 8 KB blocks, and it frees them in the reverse order they were allocated. The stated goal is to avoid memor…

Memory allocation pattern changed from single large allocation to two smaller allocationsAllocation/free ordering changed to LIFO-style reverse pairingPointer field added to struct that previously held an inline array
43640f8cby Jon Griffiths+24−153 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: check output amount presence before reading

This commit tightens how Blockstream Jade reads output amounts from a Partially Signed Bitcoin Transaction (PSBT). Before, the code tried to read the amount directly without first confirming it was actually present. Now it checks whether t…

Missing-field check added before sensitive value readPSBT output amount parsing hardenedDefensive validation of libwally presence flags
9f2b916dby Jon Griffiths+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: require that all psbt bytes are consumed when parsing

This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes…

Parsing now rejects trailing/unconsumed bytes in PSBT inputChange is in the signing code path, directly affecting what the hardware wallet will signUse of stricter libwally-core parse flag (COMPLETE) indicates parser hardening
605d86acby Jon Griffiths+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

hardware: add Jade Plus design files

This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device …

5ad85661by bitcoinhelp+2573−122520 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tests: migrate low level tests

This commit only moves and reorganizes existing test code. It adds a new helper to check whether the current transport is a specific type, moves a shared wait() function into a common test package file, and migrates a large set of low-leve…

767006a0by Valerio Vaccaro+1580−54 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

mnemonic: restore recovery phrase by word number

This commit adds a new way to restore a Bitcoin wallet on a Blockstream Jade hardware device: instead of typing each recovery word, users can enter each word's one-based BIP39 number (for example, '1' for 'abandon'). The change also refact…

New user-input path for seed recovery (word numbers instead of words)Refactoring of mnemonic input/validation helpersAddition of SENSITIVE_PUSH/POP for local mnemonic buffers
99927491by roderico+580−3183 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

ui: support bounded variable-length digit entry

This commit refactors the on-screen digit-entry keypad in Blockstream Jade so callers can ask for shorter number fields (for example 4 digits instead of 6) and optionally cap the entered value. The existing 6-digit PIN and index entry beha…

New bounded numeric input path may prevent out-of-range values in future callersRefactoring centralizes input validation rather than relying on callersNo buffer-size changes observed; digit array remains DIGIT_ENTRY_SIZE (6) elements
69627745by roderico+128−332 files
No security note in commit
Open full analysis →Source commit ↗