wire: increase the serial timeout for v1.x devices
What the developer wrote
Authored by Jon Griffiths
wire: increase the serial timeout for v1.x devices
Very large messages can be sent in chunks due to serial timeouts, when
this happens make sure we have enough time to receive the remainder of
the message for these slower devices.
A future gold standard fix requires proper message framing (e.g. sending
the length of the message before the message itself).
Kudos to <dnewton@blockstream.com> for debugging.
What changed, and why it matters
This commit increases the time the Jade hardware wallet waits for the rest of a large message sent over its USB/serial connection from 2 seconds to 3 seconds, but only for older v1.x devices. The change is described as a workaround; the commit message says a proper fix would require sending the message length first so the receiver knows exactly how much data to expect. The change itself is a simple timeout bump and does not appear to introduce a security vulnerability, but it highlights a reliability issue that could, in theory, be abused to desynchronize or confuse the device by sending partial messages.
Treat this as a reliability/maintenance patch rather than a security fix. Users on Jade v1.x should update to avoid large-message timeouts. Developers should prioritize the commit message's recommended 'gold standard' fix: add proper message framing with a length prefix so the receiver can distinguish a slow-but-complete message from a stale/partial one.
Security signals we found
Timeout change for slower hardware
Commit message acknowledges incomplete message framing
No length-prefix framing present in diff
Partial-message handling remains unchanged
Workaround described as not the 'gold standard' fix
Evidence from the diff
In main/wire.c the constant TIMEOUT_TICKS is now conditional on CONFIG_BOARD_TYPE_JADE_V1_ANY. For v1.x boards it is set to 3000/portTICK_PERIOD_MS (3 seconds); for v2.x it remains 2000/portTICK_PERIOD_MS (2 seconds). The timeout governs how long the firmware waits for additional bytes before treating an in-progress serial message as stale/rejected. The commit message notes that very large messages can be sent in chunks due to serial timeouts on slower v1.x hardware, and that the real fix is proper message framing (length prefix). The diff only changes the timeout value; no parsing, memory handling, or framing logic is modified.
Changed components
main/wire.cJade v1.x serial/USB message receive pathInspect captured patch +6 / −1
diff --git a/main/wire.c b/main/wire.c
index e4cde93..5422c23 100644
--- a/main/wire.c
+++ b/main/wire.c
@@ -24,8 +24,13 @@ void build_version_info_reply(const void* ctx, CborEncoder* container);
// Flag set when main thread is busy processing a message or awaiting user menu navigation
extern uint32_t main_thread_action;
-// 2s 'no activity' stale message timeout
+#ifdef CONFIG_BOARD_TYPE_JADE_V1_ANY
+// v1.x: Use a 3s 'no activity' stale message timeout on slower HW
+static const TickType_t TIMEOUT_TICKS = 3000 / portTICK_PERIOD_MS;
+#else
+// v2.x: Use a 2s 'no activity' stale message timeout on faster HW
static const TickType_t TIMEOUT_TICKS = 2000 / portTICK_PERIOD_MS;
+#endif
// Macros for use in handle_data() as always called with fixed params
#define SEND_REJECT_MSG(code, msg, rejectedlen) \
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.