payment_request: update swapkit pubkey
What the developer wrote
Authored by Marko Bencun
payment_request: update swapkit pubkey
What changed, and why it matters
This commit simply swaps out one public key for another in a list of trusted payment-request identities used by the BitBox02 hardware wallet's swap feature. There is no code change beyond replacing the hard-coded key. On its own, the diff does not show a vulnerability being fixed; it is best understood as a routine key rotation or partner update.
Treat as a maintenance/key-rotation change. If this key update was security-relevant (for example, because the old key was compromised or a partner changed keys), the vendor should publish a short advisory or changelog note explaining why the rotation occurred. Users do not need to take action beyond keeping firmware updated.
Security signals we found
Hard-coded trusted public key changed (key rotation / identity update)
No security framing in commit message or diff
No advisory, CVE, researcher credit, or incident reference supplied
Evidence from the diff
The change updates the SWAPKIT identity public key in payment_request.rs. The old key (03…32ff) is replaced with a new key (02…8a90d). No logic, validation, or parsing changes are present. The commit message only says ‘update swapkit pubkey’ and does not mention security, a vulnerability, a report, or a CVE.
Changed components
BitBox02 firmware Rust APIsrc/rust/bitbox02-rust/src/hww/api/payment_request.rsSWAPKIT payment-request identityInspect captured patch +1 / −1
diff --git a/src/rust/bitbox02-rust/src/hww/api/payment_request.rs b/src/rust/bitbox02-rust/src/hww/api/payment_request.rs
index 7284710..f0f9dcf 100644
--- a/src/rust/bitbox02-rust/src/hww/api/payment_request.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/payment_request.rs
@@ -35,7 +35,7 @@ const IDENTITIES: &[Identity] = &[
},
Identity {
name: "SWAPKIT",
- public_key: &hex!("03098cba9cde720171796a5c58cb774b0cd19deb62e9b51df5967aefeba34632ff"),
+ public_key: &hex!("02bf5740a2b794b33d73358d7313e9cb260058f3ac6c886fcc388d9f3f0b48a90d"),
},
#[cfg(any(feature = "testing", feature = "c-unit-testing"))]
Identity {
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.