What the developer wrote
Authored by willwang
fix bug
What changed, and why it matters
This commit fixes a bug in the 'forget password' screen of a Keystone hardware wallet. It resets a global flag called g_isTonMnemonic to false when leaving that screen. Without this reset, the wallet might incorrectly remember that it was handling a TON (The Open Network) style recovery phrase even after the user navigates away. That leftover state could lead to wrong behavior, confusion, or possibly security-relevant mistakes if the flag later influences how secrets are parsed or stored.
Review all consumers of g_isTonMnemonic to confirm whether stale true values could alter mnemonic validation, derivation paths, or secret persistence. Add regression tests covering navigation into and out of the forget-password flow for both TON and non-TON mnemonics. Consider scoping the flag to the widget context instead of a global to prevent similar bugs.
Security signals we found
Global state not reset on deinitialization
Potential stale flag affecting mnemonic/secret handling flow
UI teardown bug in password-recovery widget
Evidence from the diff
In GuiForgetPassDeInit(), a single line is added: g_isTonMnemonic = false;. This global boolean is apparently used elsewhere to distinguish TON mnemonic handling during password-recovery flows. The patch ensures the flag is cleared when the forget-password widget is torn down, preventing stale state from persisting across sessions or UI transitions. The diff alone does not show how g_isTonMnemonic is consumed, so the full security impact cannot be confirmed from this commit alone.
Changed components
src/ui/gui_widgets/gui_forget_pass_widgets.cGuiForgetPassDeInit()g_isTonMnemonic global stateInspect captured patch +1 / −0
diff --git a/src/ui/gui_widgets/gui_forget_pass_widgets.c b/src/ui/gui_widgets/gui_forget_pass_widgets.c
index c3ffabc..03d83a6 100644
--- a/src/ui/gui_widgets/gui_forget_pass_widgets.c
+++ b/src/ui/gui_widgets/gui_forget_pass_widgets.c
@@ -415,6 +415,7 @@ void GuiForgetPassInit(void *param)
void GuiForgetPassDeInit(void)
{
GUI_DEL_OBJ(g_noticeWindow)
+ g_isTonMnemonic = false;
GuiMnemonicHintboxClear();
GuiWalletRecoverySinglePhraseClear();
g_enterMnemonicCont = NULL;
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.