fix: guard Solana USB pubkey service for non-web3 builds
What the developer wrote
Authored by John Boyd
fix: guard Solana USB pubkey service for non-web3 builds
CheckSolPathSupport is only compiled under WEB3_VERSION, but the USB
pubkey service introduced with the sol-cli feature calls it
unconditionally, so cypherpunk and btc-only production builds fail to
link. Compile the Solana path only for web3 firmware and answer the
request with the existing "Unsupported coin type" error elsewhere.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
What changed, and why it matters
This commit fixes a firmware build problem, not a runtime security bug. The Solana USB public-key service was calling a function that only exists in the multi-coin 'web3' firmware variant, so the more limited 'cypherpunk' and 'bitcoin-only' firmware variants could not compile/link. The patch makes the Solana code compile only for the web3 variant and returns an 'Unsupported coin type' error for the other variants. It is a build-configuration fix with no direct exploit path.
No urgent security action required. Treat as a normal build-fix commit. Verify that non-web3 builds now link and that the 'Unsupported coin type' response is correctly handled by callers. If desired, add a regression build for cypherpunk/btc-only targets to prevent similar link failures.
Security signals we found
Build/link-time failure fix for conditional feature compilation
Explicit error response added for unsupported coin type on non-web3 builds
No input validation, memory safety, or cryptographic changes observed
Evidence from the diff
The change wraps ParseSolDerivationPath and the Solana-specific response path in #ifdef WEB3_VERSION / #else / #endif. For non-web3 builds it suppresses unused-variable warnings with (void)path and (void)pubKey and returns ‘Unsupported coin type’. This resolves an unconditional reference to CheckSolPathSupport (available only under WEB3_VERSION) that broke cypherpunk and btc-only production builds. There is no buffer overflow, memory corruption, or cryptographic flaw in the diff; the only security-relevant aspect is that the service now explicitly refuses Solana public-key requests on builds that do not include Solana support.
Changed components
src/webusb_protocol/general/eapdu_services/service_trans_usb_pubkey.cSolana USB public-key APDU serviceWEB3_VERSION, cypherpunk, and btc-only firmware build targetsInspect captured patch +10 / −0
diff --git a/src/webusb_protocol/general/eapdu_services/service_trans_usb_pubkey.c b/src/webusb_protocol/general/eapdu_services/service_trans_usb_pubkey.c
index bbee0e5..6b717bd 100644
--- a/src/webusb_protocol/general/eapdu_services/service_trans_usb_pubkey.c
+++ b/src/webusb_protocol/general/eapdu_services/service_trans_usb_pubkey.c
@@ -25,6 +25,7 @@ static bool ParseCoinType(const uint8_t *data, uint32_t len, uint32_t *coinType)
return true;
}
+#ifdef WEB3_VERSION
static bool ParseSolDerivationPath(const uint8_t *data, uint32_t len, char *path, size_t pathSize)
{
if (data == NULL || path == NULL || pathSize == 0 || len < 1) {
@@ -63,6 +64,7 @@ static bool ParseSolDerivationPath(const uint8_t *data, uint32_t len, char *path
return true;
}
+#endif
void GetDeviceUsbPubkeyService(EAPDURequestPayload_t *payload)
{
@@ -95,6 +97,13 @@ void GetDeviceUsbPubkeyService(EAPDURequestPayload_t *payload)
goto create_response;
}
+#ifndef WEB3_VERSION
+ // Solana public keys only exist in the multi-coins firmware.
+ (void)path;
+ (void)pubKey;
+ cJSON_AddStringToObject(root, "error", "Unsupported coin type");
+ goto create_response;
+#else
if (!ParseSolDerivationPath(payload->data + COIN_TYPE_SIZE,
payload->dataLen - COIN_TYPE_SIZE,
path, sizeof(path))) {
@@ -117,6 +126,7 @@ void GetDeviceUsbPubkeyService(EAPDURequestPayload_t *payload)
cJSON_AddStringToObject(root, "pubkey", pubKey);
cJSON_AddStringToObject(root, "derivationPath", path);
cJSON_AddNumberToObject(root, "coinType", coinType);
+#endif
create_response:
json_str = cJSON_PrintBuffered(root, BUFFER_SIZE_1024, false);
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.