What the developer wrote
Authored by ww3512687
update nabox pubkey
What changed, and why it matters
This commit adds a new wallet integration for Nabox in the Keystone 3 hardware wallet firmware. It changes which public keys (extended public keys, or xpubs) are shown when the user selects Nabox from the wallet list, switching from Ethereum-only data to a broader set covering Bitcoin, Ethereum, Tron, Solana, Litecoin, Dogecoin, and Bitcoin Cash. There is no security vulnerability visible in the diff; it appears to be a normal feature update.
No security action required based on the supplied commit. As with any wallet integration change, Keystone should verify that the derivation paths and chain types match Nabox's documented requirements and that the generated UR is correctly consumed by Nabox.
Security signals we found
No memory safety defects observed: allocated Solana path strings are freed after use, and public_keys is freed before return.
No input from untrusted sources is parsed or executed.
No change to signing, transaction parsing, or access-control logic.
No vendor disclosure or advisory references present in the commit or supplied materials.
Evidence from the diff
The patch introduces GuiGetNaboxData(), which builds a multi-account crypto-accounts UR containing extended public keys for ETH/BIP44, BTC native segwit/P2SH/legacy/taproot, TRX, LTC, DOGE, BCH, and ten Solana derivation paths (m/44’/501’/{0..9}’). It also adds a coin icon array and switches the WALLET_LIST_NABOX case from GuiGetMetamaskData to GuiGetNaboxData. The code frees the dynamically allocated Solana paths and the public_keys slice. No unsafe memory handling, injection, or cryptographic misuse is evident from the diff alone.
Changed components
src/ui/gui_wallet/multi/web3/gui_wallet.csrc/ui/gui_widgets/gui_connect_wallet_widgets.hsrc/ui/gui_widgets/multi/web3/gui_connect_wallet_widgets.cInspect captured patch +51 / −1
diff --git a/src/ui/gui_wallet/multi/web3/gui_wallet.c b/src/ui/gui_wallet/multi/web3/gui_wallet.c
index fcdce0e..ace7842 100644
--- a/src/ui/gui_wallet/multi/web3/gui_wallet.c
+++ b/src/ui/gui_wallet/multi/web3/gui_wallet.c
@@ -209,6 +209,42 @@ UREncodeResult *GuiGetImTokenData(void)
return GetMetamaskDataForAccountType(Bip44Standard);
}
+UREncodeResult *GuiGetNaboxData(void)
+{
+ // 19 = 9 + sol 10
+ ChainPath_t chainPaths[19] = {
+ {.path = "m/44'/60'/0'", .chainType = XPUB_TYPE_ETH_BIP44_STANDARD},
+ {.path = "m/84'/0'/0'", .chainType = XPUB_TYPE_BTC_NATIVE_SEGWIT},
+ {.path = "m/49'/0'/0'", .chainType = XPUB_TYPE_BTC},
+ {.path = "m/44'/0'/0'", .chainType = XPUB_TYPE_BTC_LEGACY},
+ {.path = "m/86'/0'/0'", .chainType = XPUB_TYPE_BTC_TAPROOT},
+ {.path = "m/44'/195'/0'", .chainType = XPUB_TYPE_TRX},
+ {.path = "m/49'/2'/0'", .chainType = XPUB_TYPE_LTC},
+ {.path = "m/44'/3'/0'", .chainType = XPUB_TYPE_DOGE},
+ {.path = "m/44'/145'/0'", .chainType = XPUB_TYPE_BCH},
+ };
+ int chainNum = NUMBER_OF_ARRAYS(chainPaths);
+ for (int i = 0; i < 10; i++) {
+ char *path = SRAM_MALLOC(BUFFER_SIZE_32);
+ snprintf_s(path, BUFFER_SIZE_32, "m/44'/501'/%d'", i);
+ chainPaths[i + 9].path = path;
+ chainPaths[i + 9].chainType = XPUB_TYPE_SOL_BIP44_0 + i;
+ }
+ ExtendedPublicKey keys[chainNum];
+ uint8_t mfp[4] = {0};
+ GetMasterFingerPrint(mfp);
+ PtrT_CSliceFFI_ExtendedPublicKey public_keys = BuildChainPaths(chainPaths, keys, chainNum);
+ UREncodeResult *urEncode = generate_common_crypto_multi_accounts_ur(mfp, sizeof(mfp), public_keys, "Keystone3");
+ for (int i = 9; i < chainNum; i++) {
+ if (chainPaths[i].path != NULL) {
+ SRAM_FREE(chainPaths[i].path);
+ }
+ }
+ CHECK_CHAIN_PRINT(urEncode);
+ SRAM_FREE(public_keys);
+ return urEncode;
+}
+
UREncodeResult *GuiGetCoreWalletData(void)
{
ChainPath_t chainPaths[] = {
diff --git a/src/ui/gui_widgets/gui_connect_wallet_widgets.h b/src/ui/gui_widgets/gui_connect_wallet_widgets.h
index adf5a74..1e5d02c 100644
--- a/src/ui/gui_widgets/gui_connect_wallet_widgets.h
+++ b/src/ui/gui_widgets/gui_connect_wallet_widgets.h
@@ -144,6 +144,7 @@ void GuiPrepareArConnectWalletView(void);
void GuiSetupArConnectWallet(void);
void GuiConnectWalletPasswordErrorCount(void *param);
void GuiConnectShowRsaSetupasswordHintbox(void);
+UREncodeResult *GuiGetNaboxData(void);
#endif
#endif /* _GUI_CONNECT_WALLET_WIDGETS_H */
diff --git a/src/ui/gui_widgets/multi/web3/gui_connect_wallet_widgets.c b/src/ui/gui_widgets/multi/web3/gui_connect_wallet_widgets.c
index 3597011..c85d18c 100644
--- a/src/ui/gui_widgets/multi/web3/gui_connect_wallet_widgets.c
+++ b/src/ui/gui_widgets/multi/web3/gui_connect_wallet_widgets.c
@@ -81,6 +81,16 @@ static const lv_img_dsc_t *g_ethWalletCoinArray[4] = {
&coinMatic,
};
+static const lv_img_dsc_t *g_naboxWalletCoinArray[7] = {
+ &coinBtc,
+ &coinEth,
+ &coinTrx,
+ &coinSol,
+ &coinLtc,
+ &coinDoge,
+ &coinBch,
+};
+
static const lv_img_dsc_t *g_okxWalletCoinArray[] = {
&coinBtc, &coinEth, &coinOkb, &coinTrx,
&coinBch, &coinLtc, &coinDash
@@ -1146,10 +1156,13 @@ void GuiConnectWalletSetQrdata(WALLET_LIST_INDEX_ENUM index)
case WALLET_LIST_ZAPPER:
case WALLET_LIST_YEARN_FINANCE:
case WALLET_LIST_SUSHISWAP:
- case WALLET_LIST_NABOX:
func = GuiGetMetamaskData;
AddCoinsFromArray(g_ethWalletCoinArray, NUMBER_OF_ARRAYS(g_ethWalletCoinArray), true, 132);
break;
+ case WALLET_LIST_NABOX:
+ func = GuiGetNaboxData;
+ AddCoinsFromArray(g_naboxWalletCoinArray, NUMBER_OF_ARRAYS(g_naboxWalletCoinArray), true, 132);
+ break;
case WALLET_LIST_IMTOKEN:
func = GuiGetImTokenData;
AddCoinsFromArray(g_ethWalletCoinArray, NUMBER_OF_ARRAYS(g_ethWalletCoinArray), true, 132);
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.