CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 37 Bitcoin

Give warning for non-ASCII BIP39-passphrase (#769)

KXfad4a0b8 View source ↗
Public commit record

What the developer wrote

Authored by Tads

58/100 · Thin
Give warning for non-ASCII BIP39-passphrase (#769)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This change relaxes a safety rule in the Krux hardware wallet firmware. Previously, if a user scanned a BIP39 passphrase QR code containing non-English/non-ASCII characters (for example accented letters or symbols), Krux would block it with an error. Now it shows a warning and lets the user proceed anyway. The risk is that different wallet software may interpret those special characters slightly differently, so the user could end up with a different Bitcoin key than expected and potentially lose access to funds. The change is intentional and documented, not a hidden bug.

Recommended action

Review whether the relaxed policy is acceptable for the project's threat model. If retained, consider additional safeguards such as requiring explicit confirmation on a second screen, showing the raw passphrase bytes, or documenting the exact normalization behavior. Users should be advised to use ASCII-only passphrases or to pre-normalize non-ASCII passphrases to NFKD before creating QR codes.

Security signals we found

01

Relaxation of input validation for BIP39 passphrase

02

Non-ASCII passphrase now allowed after warning instead of blocked

03

BIP39 NFKD normalization not performed due to firmware size constraints

04

Cross-wallet key derivation mismatch risk explicitly acknowledged in UI and docs

05

User-facing warning added in 12 languages

Risk score

Why this scored 37/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Krux

Related watches

Moderate 62 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed
518b3314by odudex+159−24 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack
d6813d88by odudex+52−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Open full analysis →Source commit ↗