AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

fix: narrow bare except blocks to stop hiding real errors (#877)

Public commit record

What the developer wrote

Authored by kkdao

100/100 · Strong
fix: narrow bare except blocks to stop hiding real errors (#877)

* fix: narrow bare except to StopIteration in display_qr_codes
* test: lock in StopIteration narrowing in display_qr_codes
* fix: narrow bare except to Exception in Key.extract_fingerprint
* test: lock in Exception narrowing in extract_fingerprint
* fix: narrow bare excepts in qr.py (IndexError / Exception)
* test: lock in detect_format Exception narrowing
* test: cover narrowed except branches in qr.py
* fix: narrow has_sd_card bare except to Exception
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit tightens several 'catch-all' error handlers in the Krux firmware so they only catch the specific problems they intend to handle. Previously, these handlers would also swallow serious system-level signals such as KeyboardInterrupt and unexpected programming errors, which could hide bugs or prevent a user from cancelling an operation. The change is defensive hardening rather than a fix for a known active attack, but it removes a class of reliability and safety bugs.

Recommended action

Treat as a worthwhile hardening change. Review whether any other bare `except:` blocks remain in the codebase and narrow them similarly. No immediate incident response is warranted unless an independent advisory links this pattern to an exploitable condition.

Security signals we found

01

Bare except blocks narrowed to specific exception types

02

KeyboardInterrupt and other BaseException signals no longer swallowed

03

Regression tests added to prevent silent error suppression

04

Defensive hardening in key derivation, QR display, QR parsing, and SD card detection

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.