What the developer wrote
Authored by Matt Gleason
fixed excess delete call
What changed, and why it matters
This tiny change removes two variables ('pu' and 'skp') from a Python 'del' cleanup statement in the code that signs Bitcoin transactions. The commit message says it fixes an 'excess delete call.' In Python, deleting a name that does not exist raises a NameError, which would crash the signing task. The patch prevents that crash but does not appear to be a security vulnerability itself; it is a bug fix for a runtime error in sensitive code.
Treat as a routine bug fix. Review whether 'pu' and 'skp' still need explicit secure cleanup elsewhere, since removing them from 'del' means they may remain in scope longer. No urgent security action is indicated by the diff alone.
Security signals we found
Change is in a sensitive operation: PSBT signing
Original code could raise NameError and crash the signing task
No explicit security claim in commit message or diff
Patch is minimal (+1/-1) and removes potentially unbound variable deletions
Evidence from the diff
In ports/stm32/boards/Passport/modules/tasks/sign_psbt_task.py, the cleanup block after PSBT signing previously executed ‘del pk, node, pu, skp’. The patch changes this to ‘del pk, node’. If ‘pu’ or ‘skp’ were not assigned in every code path (for example, if an exception occurred before they were bound), the original statement would raise NameError and abort the task. Removing the names from the ‘del’ statement avoids that crash. There is no evidence in the diff of a memory-safety issue, secret leak, or bypass; the change is defensive and minimal.
Changed components
ports/stm32/boards/Passport/modules/tasks/sign_psbt_task.pyPSBT signing taskInspect captured patch +1 / −1
### ports/stm32/boards/Passport/modules/tasks/sign_psbt_task.py
@@ -96,7 +96,7 @@ async def sign_psbt_task(on_done, psbt):
# private key no longer required
stash.blank_object(pk)
stash.blank_object(node)
- del pk, node, pu, skp
+ del pk, node
# print("result %s" % b2a_hex(result).decode('ascii'))
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.