CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

eth: implement streaming for typed data messages

BBfd2653cf View source ↗
Public commit record

What the developer wrote

Authored by Tomas Vrba

78/100 · Adequate
eth: implement streaming for typed data messages

eth: add typed data streaming to python API

show size of truncated string, show ellipsis

add a multiline string test case

- adds a test case to make use of multiline string handling code from in
the .js test generator
- adjust rust test loader to handle strings, not just bytes
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit extends an existing Ethereum data-streaming feature so it also works for EIP-712 typed messages with large data fields (e.g., a 50 KB 'bytes' field). Previously, only large Ethereum transaction data could be streamed in chunks; now the same chunking is applied to typed-message values. The change also improves on-screen display of long values by warning the user when a value is too large to show in full and by showing an ellipsis. It is a feature addition with defensive input checks, not a fix for a known vulnerability.

Recommended action

No immediate action required; this is a feature commit. Reviewers and users should ensure they upgrade both firmware and the Python library together, because the new `data_length` field is only meaningful on firmware that supports it. Wallets/integrators using the Python API will automatically benefit from streaming for large typed-message data.

Security signals we found

01

New protocol field `data_length` gated by size threshold

02

Streaming restricted to dynamic `bytes` type; other types rejected with `Error::InvalidInput`

03

Maximum streaming length capped at 1 MB (`MAX_TYPED_MSG_STREAMING_DATA_LENGTH`)

04

Mutually exclusive `value` and `data_length` enforced

05

User-facing warning when a value cannot be fully displayed

06

Extensive unit tests and generated cross-implementation test vectors added

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from BitBox02 firmware

Related watches

Low 39 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

rust: initialize C output buffers

This commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…

Undefined behavior at C/Rust FFI due to uninitialized buffers being treated as Rust slicesPotential optimizer-dependent behavior from violating Rust slice initialization rulesHardening of cryptographic output paths (SHA-256, HMAC-SHA256, HMAC-SHA512)
511018eaby benma's agent+52−2713 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

py: extract bootloader connection

This commit is a minor code cleanup in a Python helper script. It moves existing bootloader connection logic into a small nested helper function to satisfy a style checker (pylint's limit on the number of return statements). No behavior ch…

886113d0by benma's agent+10−61 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗