What the developer wrote
Authored by Qkin-Keystone
remove useless dependency
What changed, and why it matters
This commit removes unused serialization libraries from the Tron app and, more importantly, changes how a missing wallet derivation path is handled. Previously, a missing path was silently replaced with an empty default. Now the code returns an explicit error. This is a defensive hardening change that prevents the signing code from continuing with an invalid or unexpected path.
Review whether any other coin apps use unwrap_or_default() on derivation paths and apply the same pattern. Verify that RustCError::InvalidHDPath is properly handled by callers and does not cause a crash or unsafe memory issue at the C boundary.
Security signals we found
Silent fallback on missing derivation path replaced with explicit error return
Removal of unused serde/serde_json dependencies reduces attack surface
Change is in Tron signing request validation path
Evidence from the diff
The diff removes serde and serde_json dependencies from rust/apps/tron, which were apparently unused. The functional change is in rust_c/src/tron/mod.rs: tron_check_sign_request no longer uses unwrap_or_default() on the derivation path. Instead, it matches on get_path() and returns TransactionCheckResult::from(RustCError::InvalidHDPath) when None. This converts a silent fallback into an explicit error return, reducing the risk of signing with an unintended/empty HD path.
Changed components
rust/apps/tron/Cargo.tomlrust/rust_c/src/tron/mod.rsrust/Cargo.lockInspect captured patch +4 / −5
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index b166d02..35a6cd5 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -415,8 +415,6 @@ dependencies = [
"prost",
"prost-build",
"prost-types",
- "serde",
- "serde_json",
"thiserror-core",
"ur-registry",
]
diff --git a/rust/apps/tron/Cargo.toml b/rust/apps/tron/Cargo.toml
index beb1503..5274608 100644
--- a/rust/apps/tron/Cargo.toml
+++ b/rust/apps/tron/Cargo.toml
@@ -18,8 +18,6 @@ bitcoin = { workspace = true }
cryptoxide = { workspace = true }
ur-registry = { workspace = true }
thiserror = { workspace = true }
-serde = { version = "1.0", default-features = false, features = ["derive", "alloc"] }
-serde_json = { version = "1.0", default-features = false, features = ["alloc"] }
[dev-dependencies]
keystore = { workspace = true, features = ["multi_coins"] }
diff --git a/rust/rust_c/src/tron/mod.rs b/rust/rust_c/src/tron/mod.rs
index b463409..bb0a9cd 100644
--- a/rust/rust_c/src/tron/mod.rs
+++ b/rust/rust_c/src/tron/mod.rs
@@ -52,7 +52,10 @@ pub unsafe extern "C" fn tron_check_sign_request(
let x_pub_recovered = recover_c_char(x_pub);
let xpub_str = x_pub_recovered.as_str();
let sign_data = req.get_sign_data();
- let path = req.get_derivation_path().get_path().unwrap_or_default();
+ let path = match req.get_derivation_path().get_path() {
+ Some(p) => p,
+ None => return TransactionCheckResult::from(RustCError::InvalidHDPath).c_ptr(),
+ };
let transaction_type = TransactionType::from(req.get_data_type());
match transaction_type {
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.