What the developer wrote
Authored by Mathias BROUSSET
enable stack protector
What changed, and why it matters
This commit turns on a safety feature called the 'stack protector' in the Ledger Bitcoin app's build settings. The stack protector is a compiler guard that helps detect and block certain types of low-level memory attacks (stack buffer overflows) before they can take control of the device. The change itself is a hardening improvement, not a fix for a specific reported bug. It makes future exploitation of stack overflow flaws harder, but it does not remove any underlying vulnerability by itself.
Treat this as a positive hardening change. Review whether the stack protector is compatible with the BOLOS SDK and device memory limits, verify that canary violations trigger a safe abort path, and continue auditing for stack overflow root causes since the canary is a mitigation, not a fix.
Security signals we found
Compiler-level exploit mitigation enabled (stack canary)
Hardening against stack buffer overflows
No specific vulnerability or CVE referenced in commit
Change is additive hardening, not a patch for a known flaw
Evidence from the diff
The commit adds ENABLE_STACK_PROTECTOR = 1 to the Makefile and records it in CHANGELOG.md. This enables the compiler’s stack canary mechanism for the Ledger Nano (BOLOS) application. When enabled, the compiler inserts a random ‘canary’ value next to the return address on the stack and checks it before returning from a function. If a stack-based buffer overflow overwrites the canary, the app detects the mismatch and aborts, preventing control-flow hijack via return-address overwrite. This is a generic exploit-mitigation/hardening control; the diff does not identify a specific overflow bug, CVE, or prior exploit.
Changed components
Ledger Bitcoin app build configuration (Makefile)All compiled firmware functions eligible for stack canary instrumentationInspect captured patch +11 / −0
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4bae8e6..45869f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
Dates are in `dd-mm-yyyy` format.
+## [2.X.X] - XX-XX-2026
+
+### Added
+
+- Enable stack protector
+
## [2.4.6] - 30-03-2026
### Changed
diff --git a/Makefile b/Makefile
index 5af2f55..6923dd9 100644
--- a/Makefile
+++ b/Makefile
@@ -143,6 +143,11 @@ ENABLE_NBGL_QRCODE = 1
# Production enabled SWAP flag
ENABLE_SWAP = 1
+########################################
+# Stack protection features #
+########################################
+ENABLE_STACK_PROTECTOR = 1
+
########################################
# Features disablers #
########################################
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.