CommitWatch RSS
FD
← Watched projectsVendor accountability

Foundation

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Informational 24 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #665 from Foundation-Devices/casa-crypto-account-export

This commit adds a new feature to Foundation's Passport hardware wallet that exports two cryptographic public keys for Casa wallet registration: the master extended public key and a separate Casa-specific key derived at path m/45'. The key…

New key-export surface: two public keys (master + m/45' derived) are now exported togetherSensitive material is public-key/chain-code only; no private keys are exportedExport channels remain QR and microSD, unchanged from prior Casa export behavior
5e499107by mjg-foundation+291−315 files
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #669 from Foundation-Devices/add-native-unchained-connect-wallet

This commit adds support for the Unchained wallet to the Passport hardware wallet. Most of the change is normal feature code, but it also introduces a new way to feed already-encoded data into the QR encoder and tightens up the encoder so …

New unsafe FFI function `ur_encoder_start_raw` added with documented safety preconditionsUR type string is validated (length, charset, UTF-8) before use in encoderEncoder now tracks a `started` flag and returns empty output if not started, reducing use-after-free/misuse risk
26bd36d5by mjg-foundation+426−1812 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #655 from Foundation-Devices/sft-7320-entropy-hardening

This firmware update hardens the way Passport generates random numbers. Previously, a failing or stuck hardware random-number generator could silently produce weak or repeated values, which is dangerous for creating secret keys. The patch …

Fail-closed RNG error handling: persistent seed/clock errors now trigger a fatal handler instead of returning potentially weak valuesST-recommended seed-error recovery (RM0433 section 34.3.7): clear SEIS and flush 12 discard words, with bounded retry attemptsDuplicate and zero-value rejection in rng_try_sample to avoid returning stuck or invalid RNG output
0f1a5325by mjg-foundation+150−379 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 71 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #675 from Foundation-Devices/fix/verify-change-before-review

This firmware update moves the verification of Bitcoin 'change' addresses to happen before the user reviews the transaction on screen. Previously, the device checked whether change outputs truly belonged to the wallet only after the user h…

Reorders security-critical validation to occur before user approvalValidates change-output ownership before the review screen hides those outputsPrevents transaction signing if change derivation does not match the PSBT
1fea63c8by Jacksper13+174−454 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: skip change verification for transactions without change

This commit changes how the Passport hardware wallet reviews Bitcoin transactions that have no 'change' output. Previously, the wallet would always run a change-verification step that opens the secure key store, even when there was no chan…

Change reduces unnecessary access to the key store during transaction reviewNo cryptographic check is removed for transactions that actually contain changeUI label changed to more accurately describe the operation being performed
3df93748by Jacksper13+36−112 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 83 · Strong
FD FoundationPassport firmware BitcoinHardware wallets

SFT-8098: complete change verification before transaction review

This commit moves a safety check earlier in the process of approving a Bitcoin transaction on the Passport hardware wallet. Previously, the wallet verified that 'change' outputs (money going back to your own wallet) truly belonged to you o…

Change-address verification moved from post-approval signing stage to pre-review stagePSBT change output ownership now proved before user is shown transaction detailsSensitive key derivation context closed before transaction review is displayed
fb88001cby Jacksper13+150−464 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #673 from Foundation-Devices/SFT-7945-add-pytest-to-devshell

This commit is a routine development tooling and cleanup change. It adds the Pytest testing framework to the project's Nix development shell, fixes a test runner path, adds a GitHub Actions workflow to run simulator tests automatically, an…

d8ee1164by mjg-foundation+101−25825 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #648 from Foundation-Devices/dependabot-host-tooling-hygiene

This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, …

Dependency version bump of a library with known historical vulnerabilities (Pillow 8.x)Constraint now requires Python 3.10+ alongside the newer Pillow major versionChange is limited to host tooling files (pyproject.toml, setup.py, requirements-optional.txt, tox.ini, DEVELOPMENT.md)
d6c05830by Jacksper13+6−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #649 from Foundation-Devices/bitcoin-safe-wallet-flow

This commit adds support for a new Bitcoin software wallet called 'Bitcoin Safe' to the Passport hardware wallet firmware. It is a straightforward feature addition that registers the wallet in the firmware's list of supported software wall…

9f1e36b0by Jacksper13+27−03 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #653 from Foundation-Devices/show-op-return-output-amount

This update changes how the Passport hardware wallet displays Bitcoin transaction outputs that carry data (OP_RETURN outputs). Previously, only the embedded message was shown. Now the device also shows the amount of bitcoin assigned to tha…

UI spoofing hardening: user-controlled OP_RETURN data is now escaped before renderingNew display of OP_RETURN output amount reduces risk of hidden value leakageUnit test includes an attacker-controlled message simulating fake Amount/Destination headings
433c4a20by Jacksper13+79−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #660 from Foundation-Devices/fix/legacy-settings-overflow

This commit fixes a bug in how the Passport hardware wallet saves its settings to internal flash memory. Previously, the code checked whether the settings data was too large only after it had already picked and erased a flash storage slot.…

Buffer size validation moved before flash write/erase operationsReplaced broken 'assert false' crash path with explicit ValueErrorAdded unit test for oversized settings rejection
180e183dby Jacksper13+34−113 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 78 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

tooling: constrain tox Pillow dependency (SFT-7281)

This commit tightens a software dependency used only in testing/development tooling. It prevents an automated test environment from installing old, known-vulnerable versions of the Pillow image library when running under Python 3.10. The c…

Dependency constraint added to block known-vulnerable Pillow versionsCommit message acknowledges prior path could install an older vulnerable releaseChange is in Trezor external module tooling, not Passport firmware runtime
56799183by Jack+2−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 73 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #662 from Foundation-Devices/fix/unverified-psbt-fees

This firmware update fixes a security issue in the Passport hardware wallet's handling of Bitcoin transaction fees. Previously, when a transaction file (PSBT) only provided a claimed input amount without the full previous transaction to pr…

UI now displays 'Unverified' instead of a numeric network fee when input amounts cannot be independently verifiedNew assertion prevents witness/non-witness UTXO value or scriptPubKey mismatch for the same inputHistory-cache amount updates are deferred until after cryptographic proof of input ownership is completed
7b64e920by Jacksper13+336−627 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #661 from Foundation-Devices/fix/seedqr-validation

This update tightens the checks on SeedQR codes, which are QR codes that encode a wallet's backup seed phrase as numbers. Before, the decoder might accept invalid or oddly-sized numeric strings and either crash or produce an incorrect seed…

Input validation added to seed-import pathOut-of-range BIP-39 word index now rejected explicitlyNon-digit characters rejected before integer conversion
2c41d1c5by Jacksper13+59−63 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 28 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

fixed excess delete call

This tiny change removes two variables ('pu' and 'skp') from a Python 'del' cleanup statement in the code that signs Bitcoin transactions. The commit message says it fixes an 'excess delete call.' In Python, deleting a name that does not e…

Change is in a sensitive operation: PSBT signingOriginal code could raise NameError and crash the signing taskNo explicit security claim in commit message or diff
1b2efc8fby Matt Gleason+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 18 · Opaque
FD FoundationPassport firmware BitcoinHardware wallets

fixed format

This commit adds a single blank line between two test functions to fix code formatting. It makes no functional changes to the firmware or its tests.

52ade0a1by Matt Gleason+1−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 58 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Merge pull request #672 from Foundation-Devices/fix/validate-local-multisig-xpub

This update fixes a validation gap when importing multisig wallets into the Passport hardware wallet. Previously, the device only checked that the public key matched; now it also checks the chain code. Without this check, a tampered extend…

Incomplete cryptographic input validation (public key only, not full xpub)Potential acceptance of tampered extended public keys in multisig wallet importFix adds chain_code equality check alongside existing public_key equality check
b1756906by Jacksper13+95−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
FD FoundationPassport firmware BitcoinHardware wallets

SFT-7945: test suite working in devshell, removed unused translation

This commit is a routine cleanup and test-infrastructure change. It removes an unused translation system (translation files, imports, and a test), updates linting rules to no longer exclude the now-removed translation folder, and fixes the…

d8353514by Matt Gleason+25−21420 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Integrate PSBT fee and amount validation

This commit adds a test fixture flag called witness_utxo to a fake PSBT input object used in unit tests, and documents a changelog entry about marking network fees as 'unverified' when a PSBT input's UTXO data cannot be verified. The actua…

PSBT fee/amount validationunverifiable inputs flagged as unverifiedwitness UTXO handling
409137c9by Jack+2−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 45 · Thin
FD FoundationPassport firmware BitcoinHardware wallets

Reuse sensitive values during PSBT validation

This firmware update changes how Passport validates Bitcoin transaction files (PSBTs) before signing. It makes two main improvements: it reuses the wallet's secret seed for fewer key-derivation operations, and it verifies that the claimed …

Deferred and batched sensitive key derivation during PSBT validationAmount-cache update moved after ownership/key-path proofNew assertion to block re-signing already-signed non-multisig inputs
f88420bfby Jack+72−213 files
Vendor flagged security relevance
Open full analysis →Source commit ↗