AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

feat(zcash): tag outputs to the wallet's own address as Mine

Public commit record

What the developer wrote

Authored by John Boyd

85/100 · Strong
feat(zcash): tag outputs to the wallet's own address as Mine

The review screen previously computed shielded output ownership via the
IVK scope check and then discarded the external-scope result, so an
output paying the wallet's own external Orchard or Ironwood receiver
rendered like a payment to a foreign address. Propagate the ownership
flag through ParsedTo and DisplayTo and render a "Mine" tag on output
rows, with the existing "Change" tag taking precedence for
internal-scope outputs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a UI labeling bug in the Keystone hardware wallet's Zcash transaction review screen. Previously, when a user sent Zcash to one of their own shielded addresses (an 'external' address, not a change address), the device displayed it as if it were a payment to a stranger. Now it shows a 'Mine' tag so the user can recognize it as their own address. This is a user-experience and anti-confusion improvement, not a vulnerability that lets an attacker steal funds.

Recommended action

Treat as a routine UX fix. No security patch urgency. Users benefit from clearer transaction review for Zcash self-transfers and shielded pool migrations.

Security signals we found

01

UI mislabeling of self-owned Zcash shielded outputs

02

New `is_mine` ownership flag propagated across Rust/C FFI boundary

03

No change to signing logic, key handling, or transaction validation

Risk score

Why this scored 20/100

Our methodology →
Potential impact 3/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.