sign_tx: rename get_commitments_data and document it
What changed, and why it matters
This commit renames a function from get_commitment_data to params_commitment_data, moves a helper function earlier in the file to remove a forward declaration, and adds documentation comments. The commit message explicitly states there are no functional changes, and the diff shows only renaming, reordering, and comment additions with no logic changes.
No security action required; this is a non-functional refactor.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change is a pure refactor in the transaction signing code. It renames get_commitment_data() to params_commitment_data() across sign_tx.c, sign_utils.c, and sign_utils.h. It also moves verify_explicit_proofs() from later in sign_utils.c to before params_commitment_data(), eliminating the need for a forward declaration. A header comment is added documenting the return semantics. No algorithmic, control-flow, or data-handling changes are present.
Changed components
main/process/sign_tx.cmain/process/sign_utils.cmain/process/sign_utils.hInspect captured patch +45 / −46
diff --git a/main/process/sign_tx.c b/main/process/sign_tx.c
index d0c969d..fcbfe5e 100644
--- a/main/process/sign_tx.c
+++ b/main/process/sign_tx.c
@@ -608,7 +608,7 @@ static void sign_tx_impl(jade_process_t* process, const bool for_liquid)
// Verify any blinding info for this input - note can only use blinded inputs
commitment_t c;
- if (get_commitment_data(¶ms, &c, NULL, &errmsg)) {
+ if (params_commitment_data(¶ms, &c, NULL, &errmsg)) {
JADE_ASSERT(!errmsg);
// Valid input commitments: update the summary
asset_summary_update(in_sums, num_in_sums, c.asset_id, sizeof(c.asset_id), c.value);
diff --git a/main/process/sign_utils.c b/main/process/sign_utils.c
index 9cd18ac..82e3ed8 100644
--- a/main/process/sign_utils.c
+++ b/main/process/sign_utils.c
@@ -276,10 +276,46 @@ bool asset_summary_validate(asset_summary_t* sums, const size_t num_sums)
}
#ifdef CONFIG_SPIRAM
-static bool verify_explicit_proofs(void* ctx);
-#endif
+// Workaround to run 'wally_explicit_surjectionproof_verify()' and 'wally_explicit_rangeproof_verify()'
+// on a temporary stack, as the underlying libsecp calls require over 50kb of stack space.
+// NOTE: devices without SPIRAM do not have sufficient free memory to be able to do this verification,
+// so atm we exclude it for those devices.
+static bool verify_explicit_proofs(void* ctx)
+{
+ JADE_ASSERT(ctx);
+
+ const ext_commitment_t* ec = (const ext_commitment_t*)ctx;
+ const commitment_t* c = &ec->c;
+ JADE_ASSERT(c->content & (COMMITMENTS_ASSET_BLIND_PROOF | COMMITMENTS_VALUE_BLIND_PROOF));
+
+ if (c->content & COMMITMENTS_ASSET_BLIND_PROOF) {
+ uint8_t reversed_asset_id[sizeof(c->asset_id)];
+ reverse(reversed_asset_id, c->asset_id, sizeof(c->asset_id));
-bool get_commitment_data(
+ // NOTE: Appears to require ~52kb of stack space
+ if (wally_explicit_surjectionproof_verify(c->asset_blind_proof, sizeof(c->asset_blind_proof), reversed_asset_id,
+ sizeof(reversed_asset_id), ec->asset_generator, sizeof(ec->asset_generator))
+ != WALLY_OK) {
+ // Failed to verify explicit asset proof
+ return false;
+ }
+ }
+
+ if (c->content & COMMITMENTS_VALUE_BLIND_PROOF) {
+ // NOTE: Appears to require ~40kb of stack space
+ if (wally_explicit_rangeproof_verify(c->value_blind_proof, c->value_blind_proof_len, c->value,
+ ec->value_commitment, sizeof(ec->value_commitment), ec->asset_generator, sizeof(ec->asset_generator))
+ != WALLY_OK) {
+ // Failed to verify explicit value proof
+ return false;
+ }
+ }
+
+ return true;
+}
+#endif // CONFIG_SPIRAM
+
+bool params_commitment_data(
CborValue* item, commitment_t* commitment, const struct wally_tx_output* const txout, const char** errmsg)
{
JADE_ASSERT(item);
@@ -482,7 +518,7 @@ bool params_trusted_commitments(
}
// Populate commitments data for the tx output if present
- get_commitment_data(&arrayItem, &commitments[i], &tx->outputs[i], &errmsg);
+ params_commitment_data(&arrayItem, &commitments[i], &tx->outputs[i], &errmsg);
if (errmsg) {
goto cleanup;
}
@@ -506,46 +542,6 @@ cleanup:
return true;
}
-#ifdef CONFIG_SPIRAM
-// Workaround to run 'wally_explicit_surjectionproof_verify()' and 'wally_explicit_rangeproof_verify()'
-// on a temporary stack, as the underlying libsecp calls require over 50kb of stack space.
-// NOTE: devices without SPIRAM do not have sufficient free memory to be able to do this verification,
-// so atm we exclude it for those devices.
-static bool verify_explicit_proofs(void* ctx)
-{
- JADE_ASSERT(ctx);
-
- const ext_commitment_t* ec = (const ext_commitment_t*)ctx;
- const commitment_t* c = &ec->c;
- JADE_ASSERT(c->content & (COMMITMENTS_ASSET_BLIND_PROOF | COMMITMENTS_VALUE_BLIND_PROOF));
-
- if (c->content & COMMITMENTS_ASSET_BLIND_PROOF) {
- uint8_t reversed_asset_id[sizeof(c->asset_id)];
- reverse(reversed_asset_id, c->asset_id, sizeof(c->asset_id));
-
- // NOTE: Appears to require ~52kb of stack space
- if (wally_explicit_surjectionproof_verify(c->asset_blind_proof, sizeof(c->asset_blind_proof), reversed_asset_id,
- sizeof(reversed_asset_id), ec->asset_generator, sizeof(ec->asset_generator))
- != WALLY_OK) {
- // Failed to verify explicit asset proof
- return false;
- }
- }
-
- if (c->content & COMMITMENTS_VALUE_BLIND_PROOF) {
- // NOTE: Appears to require ~40kb of stack space
- if (wally_explicit_rangeproof_verify(c->value_blind_proof, c->value_blind_proof_len, c->value,
- ec->value_commitment, sizeof(ec->value_commitment), ec->asset_generator, sizeof(ec->asset_generator))
- != WALLY_OK) {
- // Failed to verify explicit value proof
- return false;
- }
- }
-
- return true;
-}
-#endif // CONFIG_SPIRAM
-
static bool add_output_info(
commitment_t* commitments, const struct wally_tx_output* txoutput, output_info_t* outinfo, const char** errmsg)
{
diff --git a/main/process/sign_utils.h b/main/process/sign_utils.h
index cc4f8f5..992307c 100644
--- a/main/process/sign_utils.h
+++ b/main/process/sign_utils.h
@@ -28,7 +28,10 @@ bool params_trusted_commitments(
TxType_t params_additional_info(jade_process_t* process, CborValue* params, const struct wally_tx* tx, TxType_t* txtype,
bool* is_partial, asset_summary_t** in_sums, size_t* num_in_sums, asset_summary_t** out_sums, size_t* num_out_sums);
-bool get_commitment_data(
+// Returns true if commitments are present and validated correctly.
+// Returns false otherwise, with errmsg set if an error occurred, or
+// NULL if no commitment data was present.
+bool params_commitment_data(
CborValue* item, commitment_t* commitment, const struct wally_tx_output* const txout, const char** errmsg);
bool asset_summary_update(
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.