Re-enabling HAVE_APPLICATION_FLAG_DERIVE_MASTER for bitcoin_recovery variant to allow all derivations paths including non-hardened ones
What the developer wrote
Authored by Michael Evans
Re-enabling HAVE_APPLICATION_FLAG_DERIVE_MASTER for bitcoin_recovery variant to allow all derivations paths including non-hardened ones
(cherry picked from https://github.com/LedgerHQ/app-bitcoin-new/pull/408)
What changed, and why it matters
This commit re-enables a build flag for a special 'bitcoin_recovery' app variant that lets it derive any key path, including non-hardened ones. The change is intentional and limited to a recovery/debug variant, not the main Bitcoin app. It is not a vulnerability by itself, but it removes a restriction on a variant that already had broad permissions, so it slightly increases the risk surface if that variant is misused or compromised.
Verify that the bitcoin_recovery variant is only distributed through controlled/debug channels and cannot be installed as the main Bitcoin app. Review PR #408 for full context and any related security discussion. No immediate patch is indicated, but treat this variant as high-privilege and restrict its distribution.
Security signals we found
Re-enables master-key derivation flag for a specific app variant
Variant already permits all derivation paths
Comment explicitly warns against compiling mainnet with this flag
Cherry-picked from a public pull request (#408)
Evidence from the diff
The Makefile change sets HAVE_APPLICATION_FLAG_DERIVE_MASTER=1 for the bitcoin_recovery build variant. This flag tells the Ledger OS to allow the app to derive keys from the master seed without path restrictions. The variant already had PATH_APP_LOAD_PARAMS=”” (all paths permitted), so the flag is needed for the OS to honor that policy. The commit message and nearby comment indicate this is for a recovery/debug variant and should not be used for the mainnet app.
Changed components
Ledger Bitcoin app Makefilebitcoin_recovery build variantInspect captured patch +1 / −0
diff --git a/Makefile b/Makefile
index 381f3fc..658453d 100644
--- a/Makefile
+++ b/Makefile
@@ -97,6 +97,7 @@ else ifeq ($(COIN),bitcoin)
else ifeq ($(COIN),bitcoin_recovery)
# Application allowed derivation paths (all paths are permitted).
PATH_APP_LOAD_PARAMS = ""
+ HAVE_APPLICATION_FLAG_DERIVE_MASTER = 1
# the version for performance tests automatically approves all requests
# there is no reason to ever compile the mainnet app with this flag
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.