CommitWatch RSS
FD
← Watched projectsVendor accountability

Foundation

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Moderate 57 AI analysisMessage 55 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Preserve hardened firmware verification result

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the speci…

Hardened firmware verification result preservationReplacement of bool with secresult for security-critical return valueBootloader update path depends on firmware validity check
a6efb276by Jack+5−51 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

Harden firmware update validation

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new…

Bypassed/missing cryptographic verification path hardenedFirmware update signature check moved to unconditional executionCurrent firmware invalid state no longer skips new firmware signature verification
b157473cby Jack+30−261 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: removed more branching from mnemonic decode process

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, reg…

Branchless, constant-time-style copy of sensitive input wordsMasking of post-delimiter bytes to zero to avoid information leakage via memory access patternsRemoval of conditional stores that depended on word length
d0edb18aby Matt Gleason+13−71 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: refined more comments

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

e58baa89by Matt Gleason+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: improved comments

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

42cad0d8by Matt Gleason+9−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 60 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: responded to more feedback, needs testing and evaluation

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timin…

Timing-side-channel mitigation: outer loop iteration count made independent of mnemonic word countOut-of-bounds read prevention: inner loop index bounded against sizeof(padded)-1Off-by-one fix: inner loop bound changed from BIP39_MAX_WORD_LEN-1 to BIP39_MAX_WORD_LEN
42f95ed8by Matt Gleason+25−181 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: made more parts of mnemonic parsing and fetching constant time

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each wo…

Constant-time / secret-independent control-flow hardeningRemoval of input-length-dependent loops in mnemonic parsingRemoval of early returns on invalid word length
5a0cc5edby Matt Gleason+52−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 75 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: first pass at anti-sidechannel round 2, needs testing and evaluation

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely re…

Constant-time/side-channel hardeningFixed-width wordlist storage to avoid out-of-bounds reads in constant-time comparisonRemoval of unreliable wall-clock timing assertions from CI tests
2c7dc29fby Matt Gleason+22−224 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 81 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Pass expected_address through QR message signing path

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an ex…

Adds expected_address validation to a previously unvalidated code pathMirrors an existing security control from another input path (microSD / PR #636)Separates canonical/raw address used for verification from human-readable stylized address used for display
80fda3a1by Jack+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 50 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-6378: Fix mnemonic_to_bits() and ct_word_eq() to be constant time.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match a…

Timing side-channel mitigation in mnemonic decodingConstant-time string comparison added (`ct_word_eq`)Unconditional full wordlist scan to avoid index-dependent timing
f8311ca7by Ken Carpenter+238−183 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4441: Update Rust dependencies.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the…

Cryptographic signing API change: removal of Message wrapper in Schnorr signing pathDependency version bumps for security-sensitive crates (secp256k1, bitcoin_hashes)No explicit security advisory, CVE, or vendor security note present in commit or supplied references
efd6bdb3by Jean-Pierre De Jesus DIAZ+16−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-4389: Update copyright e-mail address.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no securit…

8c1f220bby Jean-Pierre De Jesus DIAZ+735−735728 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

SFT-3834: added microsd message signing

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for healt…

No new cryptographic operations introduced; existing sign_text_file_task is reusedNo changes to input validation length checks or address-type handlingFile filter now excludes files containing '-signed' to avoid re-signing output files
e47977e3by Matt Gleason+37−114 files
No security note in commit
Open full analysis →Source commit ↗