AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 48 Bitcoin

feat(nufi-tron): update check/parse/sign func

Public commit record

What the developer wrote

Authored by qkin

57/100 · Thin
feat(nufi-tron): update check/parse/sign func
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit refactors how the Keystone 3 hardware wallet handles TRON (TRX) transactions. It switches the signing pipeline from accepting a custom JSON transaction description to accepting a raw protobuf transaction, and it tightens the HD path validation. The change is mostly a feature update for NuFi TRON support, but it also removes some address-derivation checks that previously ensured the transaction's 'from' address matched the wallet's key. That removal could, in theory, make it easier for a malicious companion app to ask the device to sign a transaction that does not belong to the wallet, though the companion app still needs to pass the wallet's master fingerprint and xpub checks. There is no explicit security bug or exploit shown in the diff, but the change is security-relevant because it alters the trust boundary between the host and the device.

Recommended action

Review the new protobuf parsing paths for malformed contract data (e.g., out-of-bounds reads in TriggerSmartContract data slicing at indices 16..36 and 36..68), confirm that `check_tx_request` is always invoked and its result enforced before `sign_tx_request`, and verify that the master-fingerprint check in `tron_check_sign_request` cannot be bypassed by a host that supplies a matching xpub but a different derivation path. Also ensure the removed JSON parser did not provide stronger input validation than the new raw protobuf decoder.

Security signals we found

01

Changed transaction input format from JSON to raw protobuf, altering the parser's attack surface

02

Removed seed-derived address equality check in sign_tx_request

03

Added HD path coin-type enforcement (194'/195')

04

Added master-fingerprint comparison in the Rust C bridge before transaction check

05

Simplified check_tx_request to compare xpub-derived address against protobuf 'from' address

06

Removed unused imports and dead code, reducing attack surface

Risk score

Why this scored 48/100

Our methodology →
Potential impact 12/30
Exploitability 10/25
Stealth signal 8/15
Affected reach 9/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.