AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 33 Bitcoin

otp: added qr for otp

Public commit record

What the developer wrote

Authored by Austin-Fulbright

53/100 · Thin
otp: added qr for otp

Co-authored-by: Daniel Newton <dnewton@blockstream.com>
Co-authored-by: Jon Griffiths <jon_p_griffiths@yahoo.com>
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit adds a feature to Blockstream Jade hardware wallets that lets users display an OTP (one-time password) account's secret as a QR code on the device screen. The previous code had a placeholder 'Export is not implemented yet' message; now it loads the OTP URI, converts it to a QR code, and shows it. Displaying a secret on screen is an intentional feature, but it increases the risk that someone with physical access or a camera could steal the OTP secret. There is no evidence in the commit of a vulnerability, backdoor, or unauthorized data leak—this is a user-facing export function.

Recommended action

Review the full implementation to ensure the OTP URI is cleared from memory promptly, that the QR display requires explicit user confirmation, and that the new BTN_OTP_DETAILS_SECRET event has a safe handler if enabled. Consider whether this feature should require additional authentication or a warning that the secret will be exposed. No immediate patch is required for a vulnerability, but treat this as a sensitive feature addition.

Security signals we found

01

New user-initiated OTP secret export via QR code

02

Secret URI loaded into memory and rendered as QR

03

SENSITIVE_PUSH/SENSITIVE_POP used for URI and icon data

04

New BTN_OTP_DETAILS_SECRET event declared but no handler visible in this commit

05

No input validation beyond length and load success

Risk score

Why this scored 33/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.