feat(wallet): add IOTA chain type to check_hardware_call_path()
What the developer wrote
Authored by Thoralf-M
feat(wallet): add IOTA chain type to check_hardware_call_path()
What changed, and why it matters
This commit adds support for the IOTA cryptocurrency to a function that checks whether a requested wallet operation matches a known, safe derivation path. It is a routine feature addition that maps the ticker 'IOTA' to the standard IOTA BIP-44 path 'm/44'/4218''. There is no direct evidence in the commit that this fixes a security vulnerability; it simply extends an allow-list to cover another chain.
Treat as a normal feature addition. Review whether IOTA's BIP-44 coin type 4218 is correct and whether any related UI, signing, or transaction parsing code also needs IOTA support. No urgent security action is indicated by this commit alone.
Security signals we found
Adds a new chain identifier to a derivation-path allow-list
No memory-safety, cryptographic, or authorization changes present
No bug fix, bounds check, or input-sanitization changes present
Evidence from the diff
The change inserts one match arm in check_hardware_call_path() in rust/rust_c/src/wallet/mod.rs, mapping the chain identifier ‘IOTA’ to the BIP-44 derivation path ‘m/44’/4218’‘. The function appears to validate that a hardware call’s derivation path belongs to a recognized chain before proceeding. Without this entry, IOTA-related calls would fall through to the default arm and return success(false), likely rejecting the operation. The patch is additive and follows the existing pattern for other chains.
Changed components
rust/rust_c/src/wallet/mod.rscheck_hardware_call_path()Inspect captured patch +1 / −0
diff --git a/rust/rust_c/src/wallet/mod.rs b/rust/rust_c/src/wallet/mod.rs
index 1d604e2..2256b0b 100644
--- a/rust/rust_c/src/wallet/mod.rs
+++ b/rust/rust_c/src/wallet/mod.rs
@@ -104,6 +104,7 @@ pub extern "C" fn check_hardware_call_path(
"QCK" => "m/44'/118'",
"TGD" => "m/44'/118'",
"THOR" => "m/44'/931'",
+ "IOTA" => "m/44'/4218'",
_ => return Response::success(false).c_ptr(),
};
let mut path = recover_c_char(path).to_lowercase();
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.