AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 21 Bitcoin

eth: update python api to support streaming large transactions

Public commit record

What the developer wrote

Authored by Tomas Vrba

83/100 · Strong
eth: update python api to support streaming large transactions

Adds _handle_eth_chunking() method to BitBox02 class to handle the
chunk request/response loop for ETH transactions with large data fields.

Updates eth_sign() and eth_sign_eip1559() to:
- Set data_length field when data exceeds 6144 bytes
- Call _handle_eth_chunking() to process chunk requests
- Use empty data field when streaming (data is sent incrementally)

Updates send_message.py with a streaming test case for validation.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit updates the BitBox02 Python client library to support signing Ethereum transactions whose extra data field is larger than 6,144 bytes. Instead of sending the whole transaction data in one message, the client now breaks it into chunks requested by the hardware wallet. The change is a feature addition in the Python API and test script; it does not by itself fix a known vulnerability, but it introduces new code paths that handle large transaction data and must correctly validate chunk boundaries.

Recommended action

Treat as a normal feature commit. Reviewers should verify that `_handle_eth_chunking()` cannot be driven into an infinite loop by a malicious or buggy device, that offset/length validation is robust, and that the antiklepto and non-antiklepto paths both reject unexpected response types after chunking. No immediate security patch is indicated by the available evidence.

Security signals we found

01

New chunking protocol handler added in client library

02

Boundary check on chunk offset/length against transaction_data length

03

Unexpected-response checks after chunking loop

04

Firmware version gating (>=9.26.0) for streaming large transactions

05

No vendor disclosure of a security bug in commit message or diff

Risk score

Why this scored 21/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 4/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.