What changed, and why it matters
This is a routine dependency cleanup in the BitBox02 hardware wallet firmware. The developers removed a direct dependency on a small library called 'bech32' and instead started using the version that is already included through the larger 'bitcoin' library. The actual code behavior is unchanged; this is purely about simplifying package management and avoiding version mismatches.
No security action required. Treat as a normal maintenance commit. Standard review/CI verification is sufficient.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit removes the explicit bech32 = "0.11.0" workspace dependency and the dep:bech32 feature flags from Cargo manifests. Source files that previously used bech32 via the standalone crate now import it through bitcoin::bech32, which is a re-export of the same crate. There are no functional code changes, no algorithmic changes, and no changes to error handling or validation logic. It is a build-system/maintenance refactor.
Changed components
Rust workspace dependency managementbitbox02-rust cratestreaming-silent-payments crateInspect captured patch +6 / −8
diff --git a/src/rust/Cargo.lock b/src/rust/Cargo.lock
index e631847..f411213 100644
--- a/src/rust/Cargo.lock
+++ b/src/rust/Cargo.lock
@@ -122,7 +122,6 @@ dependencies = [
name = "bitbox02-rust"
version = "0.1.0"
dependencies = [
- "bech32",
"binascii",
"bip32-ed25519",
"bip39",
@@ -961,7 +960,6 @@ dependencies = [
name = "streaming-silent-payments"
version = "0.1.0"
dependencies = [
- "bech32",
"bitbox02",
"bitcoin",
"hex",
diff --git a/src/rust/Cargo.toml b/src/rust/Cargo.toml
index 6fb74c5..506b437 100644
--- a/src/rust/Cargo.toml
+++ b/src/rust/Cargo.toml
@@ -29,7 +29,6 @@ members = [
resolver = "2"
[workspace.dependencies]
-bech32 = { version = "0.11.0", default-features = false }
# The secp-recovery feature is currently only needed in tests to make use of `RecoverableSignature`.
# Attempting to enable it conditionally only for tests somehow leads to linking errors (duplicate secp256k1 symbols).
bitcoin = { version = "0.32.7", default-features = false, features = ["secp-recovery"] }
diff --git a/src/rust/bitbox02-rust/Cargo.toml b/src/rust/bitbox02-rust/Cargo.toml
index 43a686d..2bcd079 100644
--- a/src/rust/bitbox02-rust/Cargo.toml
+++ b/src/rust/bitbox02-rust/Cargo.toml
@@ -43,7 +43,6 @@ num-bigint = { workspace = true, optional = true }
num-traits = { version = "0.2", default-features = false }
# If you change this, also change src/rust/.cargo/config.toml.
bip32-ed25519 = { git = "https://github.com/BitBoxSwiss/rust-bip32-ed25519", tag = "v0.2.1", optional = true }
-bech32 = { workspace = true, optional = true }
blake2 = { version = "0.10.6", default-features = false, optional = true }
minicbor = { version = "0.24.0", default-features = false, features = ["alloc"], optional = true }
crc = { version = "3.0.1", optional = true }
@@ -82,13 +81,11 @@ app-ethereum = [
]
app-bitcoin = [
- "dep:bech32",
"dep:miniscript",
"dep:streaming-silent-payments",
"bitbox02/app-bitcoin",
]
app-litecoin = [
- "dep:bech32",
"bitbox02/app-litecoin",
]
@@ -97,7 +94,6 @@ app-u2f = [
]
app-cardano = [
- "dep:bech32",
"dep:blake2",
"dep:minicbor",
"dep:crc",
diff --git a/src/rust/bitbox02-rust/src/hww/api/bitcoin/common.rs b/src/rust/bitbox02-rust/src/hww/api/bitcoin/common.rs
index 4872407..0eaac71 100644
--- a/src/rust/bitbox02-rust/src/hww/api/bitcoin/common.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/bitcoin/common.rs
@@ -29,6 +29,7 @@ use super::{multisig, params::Params, script};
use sha2::{Digest, Sha256};
+use bitcoin::bech32;
use bitcoin::hashes::Hash;
const HASH160_LEN: usize = 20;
diff --git a/src/rust/bitbox02-rust/src/hww/api/cardano/address.rs b/src/rust/bitbox02-rust/src/hww/api/cardano/address.rs
index dbbc085..408e287 100644
--- a/src/rust/bitbox02-rust/src/hww/api/cardano/address.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/cardano/address.rs
@@ -25,6 +25,8 @@ use pb::CardanoNetwork;
use pb::cardano_response::Response;
use pb::cardano_script_config::Config;
+use bitcoin::bech32;
+
use blake2::{
Blake2bVar,
digest::{Update, VariableOutput},
diff --git a/src/rust/bitbox02-rust/src/hww/api/cardano/sign_transaction.rs b/src/rust/bitbox02-rust/src/hww/api/cardano/sign_transaction.rs
index 6ccacaa..2b5c571 100644
--- a/src/rust/bitbox02-rust/src/hww/api/cardano/sign_transaction.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/cardano/sign_transaction.rs
@@ -21,6 +21,8 @@ use super::pb;
use alloc::string::String;
use alloc::vec::Vec;
+use bitcoin::bech32;
+
use blake2::{
Blake2bVar,
digest::{Update, VariableOutput},
diff --git a/src/rust/streaming-silent-payments/Cargo.toml b/src/rust/streaming-silent-payments/Cargo.toml
index 4e2885e..6a8eaa8 100644
--- a/src/rust/streaming-silent-payments/Cargo.toml
+++ b/src/rust/streaming-silent-payments/Cargo.toml
@@ -21,7 +21,6 @@ license = "Apache-2.0"
[dependencies]
bitcoin = { workspace = true }
-bech32 = { workspace = true }
bitbox02 = { path = "../bitbox02" }
[dev-dependencies]
diff --git a/src/rust/streaming-silent-payments/src/lib.rs b/src/rust/streaming-silent-payments/src/lib.rs
index 2d921a8..33facf3 100644
--- a/src/rust/streaming-silent-payments/src/lib.rs
+++ b/src/rust/streaming-silent-payments/src/lib.rs
@@ -19,6 +19,7 @@ extern crate alloc;
mod hash;
pub use bitcoin;
+use bitcoin::bech32;
use bitcoin::hashes::Hash;
use bitcoin::secp256k1::{self, PublicKey, Scalar, Secp256k1, SecretKey, XOnlyPublicKey};
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.