AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 59 Bitcoin

eth: fix data streaming issue when data lenght is exactly 1 byte

Public commit record

What the developer wrote

Authored by Tomas Vrba

73/100 · Adequate
eth: fix data streaming issue when data lenght is exactly 1 byte

When transaction data is streamed from the host in chunks, the
first_byte() method was called synchronously but the byte hadn't
been fetched yet for 1-byte payloads. Make first_byte() async so
it can request the byte from the host on demand, and handle the
1-byte special case in next() by returning the cached byte
directly instead of issuing a redundant chunk request.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a bug in the BitBox02 hardware wallet's Ethereum transaction signing. When signing an Ethereum transaction whose 'data' field is exactly 1 byte long and is streamed from the host computer in chunks, the device could call for the first byte before it had actually been fetched, leading to a crash or failed signing. The fix makes the first-byte lookup asynchronous so it can request the byte from the host on demand, and avoids asking for an extra chunk when the whole payload is just that one byte. New unit tests and regenerated test vectors confirm the 1-byte case now works.

Recommended action

Treat this as a security-relevant bug fix and include it in the next firmware release. Review whether any other synchronous accessors depend on host-fetched state. No immediate user action is required beyond updating firmware once available.

Security signals we found

01

Fixes a panic/invalid-input path in Ethereum transaction signing for 1-byte streamed data payloads

02

Changes synchronous first-byte access to asynchronous on-demand chunk request

03

Adds explicit 1-byte streaming unit tests for both legacy and EIP-1559 transaction paths

04

Regenerates test vectors to cover 1-byte data fields

05

Potential denial-of-service vector: malformed or minimal transaction data could crash/fail signing before the fix

Risk score

Why this scored 59/100

Our methodology →
Potential impact 18/30
Exploitability 12/25
Stealth signal 8/15
Affected reach 10/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.