Consistently use version 1 for the protocol version in js client
What the developer wrote
Authored by Salvatore Ingala
Consistently use version 1 for the protocol version in js client
While the protocol version is ignored on INS=CONTINUE_INTERRUPTED,
both the python and the Rust client consistently use version 1 for
all APDUs.
There is no reason for the JS client to behave differently.
What changed, and why it matters
This is a tiny consistency fix in the JavaScript client for the Ledger Bitcoin app. It changes one number in a command that resumes interrupted operations so it matches the Python and Rust clients. The app already ignores this version number for this specific command, so the change is unlikely to have any security effect on its own. It mainly removes an unexplained difference between client implementations.
No security action required. Treat as a normal code-quality/consistency change. If reviewing more broadly, verify that CURRENT_PROTOCOL_VERSION is indeed ignored by the firmware for CONTINUE_INTERRUPTED, as the commit message claims.
Security signals we found
Single-byte parameter alignment across clients
No cryptographic or authorization logic changed
No bounds checking, parsing, or memory handling changed
No firmware code changed
Evidence from the diff
In bitcoin_client_js/src/lib/appClient.ts, the p2 byte of the CONTINUE_INTERRUPTED APDU is changed from 0 to CURRENT_PROTOCOL_VERSION (1). The commit message states the protocol version is ignored by the firmware for INS=CONTINUE_INTERRUPTED, and both the Python and Rust clients already send version 1 for all APDUs. The patch therefore only aligns the JS client with the others; no behavior change is expected on the device side.
Changed components
bitcoin_client_js/src/lib/appClient.tsJavaScript client APDU construction for CONTINUE_INTERRUPTEDInspect captured patch +1 / −1
diff --git a/bitcoin_client_js/src/lib/appClient.ts b/bitcoin_client_js/src/lib/appClient.ts
index 990437c..4e76011 100644
--- a/bitcoin_client_js/src/lib/appClient.ts
+++ b/bitcoin_client_js/src/lib/appClient.ts
@@ -102,7 +102,7 @@ export class AppClient {
CLA_FRAMEWORK,
FrameworkIns.CONTINUE_INTERRUPTED,
0,
- 0,
+ CURRENT_PROTOCOL_VERSION,
commandResponse,
[0x9000, 0xe000]
);
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.