fix: add ltc native xpub to parse context
What the developer wrote
Authored by soralit
fix: add ltc native xpub to parse context
What changed, and why it matters
This commit adds support for a Litecoin native SegWit extended public key (xpub) when preparing public keys for transaction parsing. It shifts the array indexes for DASH and BCH to make room. There is no direct evidence in the commit that this fixes an exploitable security vulnerability; it appears to be a missing-currency-support bug that could cause address derivation or transaction display issues for Litecoin native SegWit users.
Treat as a functional bug fix rather than a critical security patch. Verify that the downstream Rust parser now receives the correct LTC native SegWit xpub and that DASH/BCH indices were updated everywhere they are referenced. Review whether missing xpubs could lead to silent wrong-address approval, and add tests for all supported coin xpubs in the parsing context.
Security signals we found
Missing public key in transaction parsing context for a supported coin type
Address-derivation mismatch risk if expected xpub is absent
User could be shown incorrect receive/change addresses for LTC native SegWit
Evidence from the diff
In PreparePublicKeys(), the code previously populated keys[6] with LTC legacy (m/49’/2’/0’) and keys[7]/[8] with DASH and BCH. The patch inserts LTC native SegWit (m/84’/2’/0’) at keys[7], shifting DASH to keys[8] and BCH to keys[9]. The function likely feeds these xpubs into a Rust/FFI parsing context so the device can derive expected addresses and verify transaction outputs. Without this key, native SegWit Litecoin transactions may not be parsed or displayed correctly, potentially leading to wrong address validation or signing failures.
Changed components
src/ui/gui_chain/gui_btc.cLitecoin native SegWit (BIP84 m/84'/2'/0') transaction parsingPreparePublicKeys() FFI public-key preparationInspect captured patch +6 / −4
diff --git a/src/ui/gui_chain/gui_btc.c b/src/ui/gui_chain/gui_btc.c
index b8e2a1e..f53c2d8 100644
--- a/src/ui/gui_chain/gui_btc.c
+++ b/src/ui/gui_chain/gui_btc.c
@@ -359,10 +359,12 @@ static void PreparePublicKeys(PtrT_CSliceFFI_ExtendedPublicKey public_keys, Exte
// ltc、dash、bch
keys[6].path = "m/49'/2'/0'";
keys[6].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_LTC);
- keys[7].path = "m/44'/5'/0'";
- keys[7].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_DASH);
- keys[8].path = "m/44'/145'/0'";
- keys[8].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_BCH);
+ keys[7].path = "m/84'/2'/0'";
+ keys[7].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_LTC_NATIVE_SEGWIT);
+ keys[8].path = "m/44'/5'/0'";
+ keys[8].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_DASH);
+ keys[9].path = "m/44'/145'/0'";
+ keys[9].xpub = GetCurrentAccountPublicKey(XPUB_TYPE_BCH);
#endif
#endif
}
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.