← Watch feed
update the string and fix the pages reused
Public commit record
45/100 · Thin
What the developer wrote
Authored by aaron
update the string and fix the pages reused
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
What changed, and why it matters
This commit fixes a page-number overlap in the secure-element storage layout and updates a user-facing help string. Previously, the RSA hash page was defined as page 36, which was also used for account status. The change gives the RSA hash its own dedicated pages (39-41) so the two purposes no longer share the same storage page. The string change makes it clearer that entering another wallet's PIN/password is part of resetting a forgotten passcode, and that failure wipes the device. The commit itself does not show an attack path, but it removes a condition that could have caused data corruption or misinterpretation of wallet state.
Recommended action
Review the secure-element manager code that reads and writes pages 36-38 and 39-41 to confirm the overlap is fully resolved in all call sites, including any factory-reset or migration paths. Verify that legacy devices upgrading from firmware using page 36 for RSA hash are handled safely (e.g., the old value is invalidated or migrated). The string change is a UX improvement and does not require a security response.
Security signals we found
01
Secure-element page-number collision fixed (page 36 reused for both account status and RSA primes hash)
02
New dedicated RSA hash pages (39-41) introduced to prevent overlapping storage use
03
User-facing string clarified to indicate passcode-reset context and device-wipe consequence
04
No input validation, buffer handling, or cryptographic logic changes visible in diff
Evidence from the diff
In src/managers/se_manager.h, PAGE_WALLET1_RSA_PRIMES_HASH was redefined from 36 to 39, and two additional constants (40, 41) were added for wallets 2 and 3. Pages 36-38 remain PAGE_ACCOUNT_STATUS_0..2. The comment explicitly states the intent: ‘clearly defined the 3 pages for RSA hash, so the page 39~41 is not used for other purpose.’ The old overlap meant the same flash page in the secure element could be written for both account-status metadata and RSA-primes-hash storage, risking state confusion or corruption. The remaining changes are i18n string updates for prove_ownership_desc in data.csv and the generated lv_i18n.c, clarifying the passcode-reset context. No code logic changes are visible in the diff beyond the page constants and strings.
Changed components
src/managers/se_manager.hsrc/ui/lv_i18n/data.csvsrc/ui/lv_i18n/lv_i18n.cInspect captured patch +15 / −9
diff --git a/src/managers/se_manager.h b/src/managers/se_manager.h
index 3f4493e..f89c36b 100644
--- a/src/managers/se_manager.h
+++ b/src/managers/se_manager.h
@@ -33,6 +33,12 @@
#define PAGE_ACCOUNT_STATUS_0 36
#define PAGE_ACCOUNT_STATUS_1 37
#define PAGE_ACCOUNT_STATUS_2 38
+// RSA hash page, 39 -> PAGE_WALLET1_RSA_PRIMES_HASH, 40 -> PAGE_WALLET2_RSA_PRIMES_HASH, 41 -> PAGE_WALLET3_RSA_PRIMES_HASH
+// clearly defined the 3 pages for RSA hash, so the page 39~41 is not used for other purpose.
+// PAGE_WALLET2_RSA_PRIMES_HASH, PAGE_WALLET3_RSA_PRIMES_HASH are not used in the code.
+#define PAGE_WALLET1_RSA_PRIMES_HASH 39
+#define PAGE_WALLET2_RSA_PRIMES_HASH 40
+#define PAGE_WALLET3_RSA_PRIMES_HASH 41
// Status page layout: a 4-byte magic + a 1-byte state (rest zero). The magic lets a blank/legacy/wiped page
// (all-zero, or random) be told apart from a real state — without it we fall back to the coarse CheckEntropy
@@ -55,7 +61,7 @@ typedef enum {
#define PAGE_WALLET1_PUB_KEY_HASH 85
#define PAGE_WALLET2_PUB_KEY_HASH 86
#define PAGE_WALLET3_PUB_KEY_HASH 87
-#define PAGE_WALLET1_RSA_PRIMES_HASH 36
+
#define PAGE_PUBLIC_INFO 88
diff --git a/src/ui/lv_i18n/data.csv b/src/ui/lv_i18n/data.csv
index ea84895..e0d3947 100644
--- a/src/ui/lv_i18n/data.csv
+++ b/src/ui/lv_i18n/data.csv
@@ -556,7 +556,7 @@ Unlock Device,24,unlock_device_fingerprint_pin_title,Use PIN or Fingerprint,PIN
,24,forgot_password_reset_passcode_intro_text,Forgot passcode?,Забыли код-пароль?,비밀번호를 잊어버렸습니까?,忘记密码?,¿Olvidaste tu código de acceso?,Passcode vergessen?,パスコードを忘れましたか？
,20,forgot_password_reset_passcode_intro_desc,Verify the seed phrase associated with this wallet to reset the passcode.Resetting your password may erase your wallet or multisig wallet data,"Проверьте начальную фразу, связанную с этим кошельком, чтобы сбросить пароль. Сброс пароля может привести к удалению данных вашего кошелька или мультиподписного кошелька",이 지갑과 연결된 구문을 확인하여 암호를 재설정합니다.암호를 재설정하면 지갑이나 다중 서명 지갑의 데이터를 지울 수 있습니다,验证与此钱包关联的助记词以重置密码.重置密码可能会擦除您的钱包或多重签名钱包数据,Verifica la frase semilla asociada a esta billetera para restablecer el código de acceso. Restablecer tu contraseña puede borrar los datos de tu billetera o billetera multisig,"Überprüfen Sie die mit dieser Brieftasche verbundene Wiederherstellungsphrase, um den Zugangscode zurückzusetzen. Das Zurücksetzen Ihres Passworts kann Ihre Brieftasche oder Multisig-Brieftaschendaten löschen.",このウォレットに関連するシードフレーズを確認してパスコードをリセットしてください.パスワードをリセットすると、ウォレットまたはマルチシグウォレットのデータが消去される可能性があります.
,20,prove_ownership_title,Prove Device Ownership,Подтвердите владение устройством,기기 소유권 증명,验证设备所有权,Demostrar propiedad del dispositivo,Geräteeigentum nachweisen,デバイスの所有権を証明
-,20,prove_ownership_desc,"Enter another wallet's PIN or password. The device will be wiped if the attempt limit is reached.","Введите PIN-код или пароль другого кошелька. Если лимит попыток будет достигнут, устройство будет сброшено.",다른 지갑의 PIN 또는 비밀번호를 입력하세요. 시도 한도에 도달하면 기기가 초기화됩니다.,请输入另一个钱包的 PIN 码或密码。达到尝试次数上限时，设备将被擦除。,"Introduce el PIN o la contraseña de otra billetera. El dispositivo se borrará si se alcanza el límite de intentos.","Geben Sie die PIN oder das Passwort einer anderen Brieftasche ein. Das Gerät wird gelöscht, wenn das Versuchslimit erreicht ist.",別のウォレットのPINまたはパスワードを入力してください。試行回数の上限に達すると、デバイスは消去されます。
+,20,prove_ownership_desc,"To continue resetting your passcode, enter the PIN or password of another wallet on this device. The device will be wiped if the attempt limit is reached.","Чтобы продолжить сброс пароля, введите PIN-код или пароль другого кошелька на этом устройстве. Если лимит попыток будет достигнут, устройство будет сброшено.",비밀번호 재설정을 계속하려면 이 기기에 있는 다른 지갑의 PIN 또는 비밀번호를 입력하세요. 시도 한도에 도달하면 기기가 초기화됩니다.,若要继续重置密码，请输入本设备上另一个钱包的 PIN 码或密码。达到尝试次数上限时，设备将被擦除。,"Para continuar restableciendo tu código de acceso, introduce el PIN o la contraseña de otra billetera en este dispositivo. El dispositivo se borrará si se alcanza el límite de intentos.","Um das Zurücksetzen Ihres Passcodes fortzusetzen, geben Sie die PIN oder das Passwort einer anderen Brieftasche auf diesem Gerät ein. Das Gerät wird gelöscht, wenn das Versuchslimit erreicht ist.",パスコードのリセットを続行するには、このデバイス上の別のウォレットのPINまたはパスワードを入力してください。試行回数の上限に達すると、デバイスは消去されます。
,28,forget_password_cancel,Cancel Password Reset?,Отменить сброс пароля?,암호 재설정 취소?,取消密码重置?,¿Cancelar restablecimiento de contraseña?,Passwort zurücksetzen abbrechen?,パスワードリセットをキャンセルしますか？
Error,28,error_box_invalid_seed_phrase,Invalid Seed Phrase,Неверная фраза,잘못된 시드 구문입니다.,助记词无效,Frase semilla no válida,Ungültige Seed-Phrase,無効なシードフレーズ
,20,error_box_invalid_seed_phrase_desc,The seed phrase you've entered is invalid. Please re-verify your backup and try again.,Введенная фраза недействительна. Проверьте ее еще раз и повторите попытку.,입력하신 시드 구문이 잘 못되었습니다. 확인하고 다시 시도하십시오.,"您输入的助记词无效.请检查您所备份的助记词,重新尝试.","La frase semilla que has ingresado es inválida. Por favor, verifica nuevamente tu respaldo e intenta de nuevo.",Der eingegebene Seed-Satz ist ungültig. Bitte überprüfen Sie Ihre Sicherung erneut und versuchen Sie es erneut.,入力したシードフレーズは無効です.バックアップを再確認して、もう一度試してください.
diff --git a/src/ui/lv_i18n/lv_i18n.c b/src/ui/lv_i18n/lv_i18n.c
index b3a05d8..830d531 100644
--- a/src/ui/lv_i18n/lv_i18n.c
+++ b/src/ui/lv_i18n/lv_i18n.c
@@ -452,7 +452,7 @@ const static lv_i18n_phrase_t en_singulars[] = {
{"forget_password_cancel", "Cancel Password Reset?"},
{"forgot_password_reset_passcode_intro_desc", "Verify the seed phrase associated with this wallet to reset the passcode.Resetting your password may erase your wallet or multisig wallet data"},
{"prove_ownership_title", "Prove Device Ownership"},
- {"prove_ownership_desc", "Enter another wallet's PIN or password. The device will be wiped if the attempt limit is reached."},
+ {"prove_ownership_desc", "To continue resetting your passcode, enter the PIN or password of another wallet on this device. The device will be wiped if the attempt limit is reached."},
{"forgot_password_reset_passcode_intro_text", "Forgot passcode?"},
{"forgot_password_reset_passcode_intro_title", "Forgot passcode?"},
{"generating_qr_codes", "Generating QR Codes"},
@@ -1411,7 +1411,7 @@ const static lv_i18n_phrase_t de_singulars[] = {
{"forget_password_cancel", "Passwort zurücksetzen abbrechen?"},
{"forgot_password_reset_passcode_intro_desc", "Überprüfen Sie die mit dieser Brieftasche verbundene Wiederherstellungsphrase, um den Zugangscode zurückzusetzen. Das Zurücksetzen Ihres Passworts kann Ihre Brieftasche oder Multisig-Brieftaschendaten löschen."},
{"prove_ownership_title", "Geräteeigentum nachweisen"},
- {"prove_ownership_desc", "Geben Sie die PIN oder das Passwort einer anderen Brieftasche ein. Das Gerät wird gelöscht, wenn das Versuchslimit erreicht ist."},
+ {"prove_ownership_desc", "Um das Zurücksetzen Ihres Passcodes fortzusetzen, geben Sie die PIN oder das Passwort einer anderen Brieftasche auf diesem Gerät ein. Das Gerät wird gelöscht, wenn das Versuchslimit erreicht ist."},
{"forgot_password_reset_passcode_intro_text", "Passcode vergessen?"},
{"forgot_password_reset_passcode_intro_title", "Passcode vergessen?"},
{"generating_qr_codes", "Generieren von QR-Codes"},
@@ -2370,7 +2370,7 @@ const static lv_i18n_phrase_t es_singulars[] = {
{"forget_password_cancel", "¿Cancelar restablecimiento de contraseña?"},
{"forgot_password_reset_passcode_intro_desc", "Verifica la frase semilla asociada a esta billetera para restablecer el código de acceso. Restablecer tu contraseña puede borrar los datos de tu billetera o billetera multisig"},
{"prove_ownership_title", "Demostrar propiedad del dispositivo"},
- {"prove_ownership_desc", "Introduce el PIN o la contraseña de otra billetera. El dispositivo se borrará si se alcanza el límite de intentos."},
+ {"prove_ownership_desc", "Para continuar restableciendo tu código de acceso, introduce el PIN o la contraseña de otra billetera en este dispositivo. El dispositivo se borrará si se alcanza el límite de intentos."},
{"forgot_password_reset_passcode_intro_text", "¿Olvidaste tu código de acceso?"},
{"forgot_password_reset_passcode_intro_title", "¿Olvidaste tu código de acceso?"},
{"generating_qr_codes", "Generando códigos QR"},
@@ -3326,7 +3326,7 @@ const static lv_i18n_phrase_t ja_singulars[] = {
{"forget_password_cancel", "パスワードリセットをキャンセルしますか？"},
{"forgot_password_reset_passcode_intro_desc", "このウォレットに関連するシードフレーズを確認してパスコードをリセットしてください.パスワードをリセットすると、ウォレットまたはマルチシグウォレットのデータが消去される可能性があります."},
{"prove_ownership_title", "デバイスの所有権を証明"},
- {"prove_ownership_desc", "別のウォレットのPINまたはパスワードを入力してください。試行回数の上限に達すると、デバイスは消去されます。"},
+ {"prove_ownership_desc", "パスコードのリセットを続行するには、このデバイス上の別のウォレットのPINまたはパスワードを入力してください。試行回数の上限に達すると、デバイスは消去されます。"},
{"forgot_password_reset_passcode_intro_text", "パスコードを忘れましたか？"},
{"forgot_password_reset_passcode_intro_title", "パスコードを忘れましたか？"},
{"generating_qr_codes", "QRコードの生成"},
@@ -4280,7 +4280,7 @@ const static lv_i18n_phrase_t ko_singulars[] = {
{"forget_password_cancel", "암호 재설정 취소?"},
{"forgot_password_reset_passcode_intro_desc", "이 지갑과 연결된 구문을 확인하여 암호를 재설정합니다.암호를 재설정하면 지갑이나 다중 서명 지갑의 데이터를 지울 수 있습니다"},
{"prove_ownership_title", "기기 소유권 증명"},
- {"prove_ownership_desc", "다른 지갑의 PIN 또는 비밀번호를 입력하세요. 시도 한도에 도달하면 기기가 초기화됩니다."},
+ {"prove_ownership_desc", "비밀번호 재설정을 계속하려면 이 기기에 있는 다른 지갑의 PIN 또는 비밀번호를 입력하세요. 시도 한도에 도달하면 기기가 초기화됩니다."},
{"forgot_password_reset_passcode_intro_text", "비밀번호를 잊어버렸습니까?"},
{"forgot_password_reset_passcode_intro_title", "비밀번호를 잊어버렸습니까?"},
{"generating_qr_codes", "QR 코드 생성"},
@@ -6195,7 +6195,7 @@ const static lv_i18n_phrase_t ru_singulars[] = {
{"forget_password_cancel", "Отменить сброс пароля?"},
{"forgot_password_reset_passcode_intro_desc", "Проверьте начальную фразу, связанную с этим кошельком, чтобы сбросить пароль. Сброс пароля может привести к удалению данных вашего кошелька или мультиподписного кошелька"},
{"prove_ownership_title", "Подтвердите владение устройством"},
- {"prove_ownership_desc", "Введите PIN-код или пароль другого кошелька. Если лимит попыток будет достигнут, устройство будет сброшено."},
+ {"prove_ownership_desc", "Чтобы продолжить сброс пароля, введите PIN-код или пароль другого кошелька на этом устройстве. Если лимит попыток будет достигнут, устройство будет сброшено."},
{"forgot_password_reset_passcode_intro_text", "Забыли код-пароль?"},
{"forgot_password_reset_passcode_intro_title", "Забыли код-пароль?"},
{"generating_qr_codes", "Генерируются QR-коды"},
@@ -7157,7 +7157,7 @@ const static lv_i18n_phrase_t zh_cn_singulars[] = {
{"forget_password_cancel", "取消密码重置?"},
{"forgot_password_reset_passcode_intro_desc", "验证与此钱包关联的助记词以重置密码.重置密码可能会擦除您的钱包或多重签名钱包数据"},
{"prove_ownership_title", "验证设备所有权"},
- {"prove_ownership_desc", "请输入另一个钱包的 PIN 码或密码。达到尝试次数上限时，设备将被擦除。"},
+ {"prove_ownership_desc", "若要继续重置密码，请输入本设备上另一个钱包的 PIN 码或密码。达到尝试次数上限时，设备将被擦除。"},
{"forgot_password_reset_passcode_intro_text", "忘记密码?"},
{"forgot_password_reset_passcode_intro_title", "忘记密码?"},
{"generating_qr_codes", "生成二维码"},
Risk score
Our methodology →Why this scored 41/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.