What the developer wrote
Authored by soralit
fix: a macro typo
What changed, and why it matters
This commit fixes a misspelled build flag (CYBERPUNK_VERSION vs CYPHERPUNK_VERSION) in the Zcash transaction handling code. Because the wrong flag was used, the Cypherpunk-specific Zcash code path was never compiled in, while the Web3 path may have been active instead. The commit also adds a debug printf showing the mnemonic type. The typo fix could affect which Zcash transaction parser and checker runs, potentially changing how Zcash transactions are validated or displayed, but the commit itself is small and does not show an active exploit.
Verify that the intended CYPHERPUNK_VERSION builds now compile and exercise the correct Zcash parser/checker. Review whether any released firmware built with the misspelled flag could have used the wrong Zcash validation path, and assess if that caused user-facing transaction display or signing differences. Remove or gate the debug printf before release.
Security signals we found
Conditional compilation typo caused intended code path to be excluded
Zcash transaction parsing/checking path selection depends on corrected macro
Debug printf added for mnemonic type (information disclosure risk minimal, development artifact)
Evidence from the diff
In src/ui/gui_chain/multi/gui_zcash.c, two occurrences of #ifdef CYBERPUNK_VERSION were corrected to #ifdef CYPHERPUNK_VERSION. This typo meant the cypherpunk-specific Zcash parsing and checking functions (parse_zcash_tx_cypherpunk, check_zcash_tx_cypherpunk) were conditionally compiled out when the intended CYPHERPUNK_VERSION macro was defined. A debug printf for MnemonicType was also added. The security relevance is conditional: if a build intended to use the Cypherpunk Zcash path, the typo would have caused the Web3 multi-coin path to be used instead, or no path at all, which could alter validation behavior. There is no direct evidence in the diff of a vulnerability being exploited.
Changed components
src/ui/gui_chain/multi/gui_zcash.cZcash transaction parsing (Cypherpunk build)Zcash transaction validation/checking (Cypherpunk build)Inspect captured patch +3 / −2
diff --git a/src/ui/gui_chain/multi/gui_zcash.c b/src/ui/gui_chain/multi/gui_zcash.c
index db3b417..122f0d8 100644
--- a/src/ui/gui_chain/multi/gui_zcash.c
+++ b/src/ui/gui_chain/multi/gui_zcash.c
@@ -41,7 +41,7 @@ void *GuiGetZcashGUIData(void)
#ifdef WEB3_VERSION
parseResult = parse_zcash_tx_multi_coins(data, sfp);
#endif
-#ifdef CYBERPUNK_VERSION
+#ifdef CYPHERPUNK_VERSION
char ufvk[ZCASH_UFVK_MAX_LEN] = {'\0'};
GetZcashUFVK(GetCurrentAccountIndex(), ufvk);
parseResult = parse_zcash_tx_cypherpunk(data, ufvk, sfp);
@@ -309,12 +309,13 @@ PtrT_TransactionCheckResult GuiGetZcashCheckResult(void)
GetZcashSFP(GetCurrentAccountIndex(), sfp);
uint32_t zcash_account_index = 0;
MnemonicType mnemonicType = GetMnemonicType();
+ printf("mnemonicType: %d\n", mnemonicType);
#ifdef WEB3_VERSION
char *xpub = GetCurrentAccountPublicKey(XPUB_TYPE_ZEC_TRANSPARENT_LEGACY);
return check_zcash_tx_multi_coins(data, xpub, sfp, zcash_account_index, mnemonicType == MNEMONIC_TYPE_SLIP39);
#endif
-#ifdef CYBERPUNK_VERSION
+#ifdef CYPHERPUNK_VERSION
char ufvk[ZCASH_UFVK_MAX_LEN + 1] = {0};
GetZcashUFVK(GetCurrentAccountIndex(), ufvk);
return check_zcash_tx_cypherpunk(data, ufvk, sfp, zcash_account_index, mnemonicType == MNEMONIC_TYPE_SLIP39);
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.