What the developer wrote
Authored by Niklas Dusenlund
clippy: warn for large futures
Large async state machines keep their captured data alive across await
points. That can silently bloat task allocations and stack usage, which
is especially risky on memory-constrained embedded targets and makes
regressions harder to spot in review.
Add the Clippy lint so oversized futures are flagged early instead of
only showing up later as memory pressure or failures.
Reference: https://rust-lang.github.io/rust-clippy/master/index.html#large_futures
What changed, and why it matters
This change adds a Rust code-quality warning (Clippy lint) that flags async functions whose internal state machines get too large. It is a preventive development tool, not a fix for an existing security bug. The commit does not change any runtime firmware behavior or patch a known vulnerability.
No immediate action required. Treat as a normal code-quality/hardening improvement. Continue monitoring for any future Clippy warnings triggered by this lint and refactor flagged async functions to reduce captured state.
Security signals we found
Memory-constrained embedded target (BitBox02 hardware wallet)
Large async futures can bloat task allocations and stack usage
Preventive static-analysis lint, not a runtime mitigation
No CVE, advisory, or exploit referenced in commit
Evidence from the diff
The commit enables the clippy::large_futures lint in the BitBox02 firmware’s Rust build and sets future-size-threshold=4096 in src/rust/.clippy.toml. Large async futures can increase stack/heap usage on an embedded device by holding captured data across await points. The change makes such cases visible during static analysis so they can be refactored before they contribute to memory pressure or instability. No unsafe code is removed, no bug is fixed, and no exploit path is addressed.
Changed components
src/CMakeLists.txtsrc/rust/.clippy.tomlRust async code in the firmware (future development only)Inspect captured patch +4 / −2
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index eeeb30b..d4ca4eb 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -258,9 +258,10 @@ if(NOT CMAKE_CROSSCOMPILING)
--manifest-path ${CMAKE_CURRENT_SOURCE_DIR}/rust/Cargo.toml
--target-dir ${RUST_BINARY_DIR}/clippy
--release
- --tests
- -- # enabled linters:
+ --tests --
+ # enabled linters:
-W clippy::use_debug
+ -W clippy::large_futures
# disabled linters:
-A clippy::large_enum_variant
-A clippy::identity_op
diff --git a/src/rust/.clippy.toml b/src/rust/.clippy.toml
new file mode 100644
index 0000000..9db73c8
--- /dev/null
+++ b/src/rust/.clippy.toml
@@ -0,0 +1 @@
+future-size-threshold=4096
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.