docs: document that commitment data must match the tx output
What the developer wrote
Authored by Jon Griffiths
docs: document that commitment data must match the tx output
What changed, and why it matters
This is a one-line documentation edit in a user manual. It adds a note that two pieces of cryptographic data supplied by the host must match the values in the transaction output being signed. There is no code change, no bug fix, and no disclosed security issue in the commit itself.
No action required. Treat as routine documentation update. If there is concern that the underlying requirement was previously undocumented and could lead to misuse, review whether the firmware already enforces this matching or whether additional validation is needed, but that is outside the scope of this commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies docs/index.rst to document that, when ‘asset_generator’ and ‘value_commitment’ are included in ‘trusted_commitments’ for a Liquid blinded transaction signing request, they must match the corresponding transaction output. The change is purely informational and does not alter firmware behavior, add validation, or patch a vulnerability.
Changed components
docs/index.rstInspect captured patch +1 / −1
diff --git a/docs/index.rst b/docs/index.rst
index e94f3aa..3e315a9 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -2018,7 +2018,7 @@ Request to sign liquid transaction inputs.
* Most fields are as described in sign_tx_legacy_request_.
* 'asset_info' is optional, but if passed should be the asset-id, contract and issuance-prevout sections of the asset registry data pertinent to the assets being transacted. If present, this allows the transaction details displayed on Jade to include assets' name, issuer and ticker fields, rather than just asset-id alone. NOTE: if passed, this data must be accurate as obtained from the asset registry json, and the fields in the expected (ie. alphabetical) order. 'asset_info' for the network policy-asset is not required.
-* 'trusted_commitments' must be passed in for each blinded output. Where an output is not blinded (eg. fee output) null may be passed.
+* 'trusted_commitments' must be passed in for each blinded output. Where an output is not blinded (eg. fee output) null may be passed.If 'asset_generator' and 'value_commitment' are included, they must match the value in the matching transaction output being signed.
* 'trusted_commitments' entries passed in here can be obtained using the get_commitments_request_, with the relevant 'blinding_key' added (which would originally be obtained from get_blinding_key_request_).
* NOTE: as of Jade fw v0.1.34, external blinding is supported, in which case the 'trusted_commitments' can be constructed by the host application. Note the 'asset_id' byte-order is that consistent with the registry data, but the 'abf' and 'vbf' fields need to be in the byte-order in which they would be used in the blinding (which may be reversed).
* 'additional_info' is only required for advanced transaction types such as asset swaps, and can be omitted for vanilla 'send payment' type transactions. If included, it contains the net movements of assets into and out of the wallet (ie. sum of inputs minus change outputs, and sum of non-change outputs per asset)
Why this scored 3/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.