Datum crypto-bip39: join list so Datum can load and display it (#799)
What the developer wrote
Authored by Odudex
Datum crypto-bip39: join list so Datum can load and display it (#799)
What changed, and why it matters
This commit fixes a display bug in Krux's Datum tool. When a user scanned a BIP39 mnemonic seed phrase from a QR code, the device received the words as a list but tried to show them as a single string, which could not render correctly. The fix joins the word list into a normal spaced sentence so the device can display it. There is no direct evidence this is a security vulnerability, only a UI/data-format bug.
Treat as a routine bug fix. No security response required unless further review shows the display failure could hide or corrupt a seed phrase in a way that affects user verification.
Security signals we found
No security-relevant keywords in commit title or message
No input validation changes
No cryptographic operation changes
No privilege or access-control changes
UI/data-format fix only
Evidence from the diff
In src/krux/pages/datum_tool.py, urobj_to_data() now converts the BIP39 word list returned by urtypes.crypto.BIP39.from_cbor(…).words into a single string via ” “.join(data). The test is updated to expect a joined mnemonic string instead of a list. The change is small, localized, and appears to correct a type mismatch between the UR/crypto-bip39 decoder (list of words) and the downstream display code (expects a string). No memory-safety, cryptographic, or input-validation issues are visible in the diff.
Changed components
src/krux/pages/datum_tool.pytests/pages/test_datum_tool.pyInspect captured patch +2 / −4
diff --git a/src/krux/pages/datum_tool.py b/src/krux/pages/datum_tool.py
index e43985b..b0fb7e6 100644
--- a/src/krux/pages/datum_tool.py
+++ b/src/krux/pages/datum_tool.py
@@ -82,6 +82,7 @@ def urobj_to_data(ur_obj):
if ur_obj.type == "crypto-bip39":
data = urtypes.crypto.BIP39.from_cbor(ur_obj.cbor).words
+ data = " ".join(data)
elif ur_obj.type == "crypto-account":
data = (
urtypes.crypto.Account.from_cbor(ur_obj.cbor)
diff --git a/tests/pages/test_datum_tool.py b/tests/pages/test_datum_tool.py
index 778085b..36b3c4d 100644
--- a/tests/pages/test_datum_tool.py
+++ b/tests/pages/test_datum_tool.py
@@ -36,10 +36,7 @@ def test_urobj_to_data(m5stickv, mocker):
MULTISIG_DESCR = "wsh(multi(1,xpub661MyMwAqRbcFW31YEwpkMuc5THy2PSt5bDMsktWQcFF8syAmRUapSCGu8ED9W6oDMSgv6Zz8idoc4a6mr8BDzTJY47LJhkJ8UB7WEGuduB/1/0/*,xpub69H7F5d8KSRgmmdJg2KhpAK8SR3DjMwAdkxj3ZuxV27CprR9LgpeyGmXUbC6wb7ERfvrnKZjXoUmmDznezpbZb7ap6r1D3tgFxHmwMkQTPH/0/0/*))#t2zpj2eu"
cases = [
- {
- "control": UR("crypto-bip39", UR_BIP39_WORDS_BYTES),
- "expected": MNEMONIC.split(" "),
- },
+ {"control": UR("crypto-bip39", UR_BIP39_WORDS_BYTES), "expected": MNEMONIC},
{
"control": UR("crypto-output", UR_OUTPUT_MULTISIG_DESCR_BYTES),
"expected": MULTISIG_DESCR,
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.