request display of path when retreiving xpubs on ledger devices for any non-standard path
What the developer wrote
Authored by Craig Raw
request display of path when retreiving xpubs on ledger devices for any non-standard path
What changed, and why it matters
This commit changes how Sparrow Wallet asks Ledger hardware wallets to show extended public keys (xpubs). It now requests that the Ledger device display the derivation path on its screen whenever the path is non-standard. This helps users verify they are exporting the correct xpub and not one from an unexpected path, reducing the risk of misleading wallet backups or address generation. The change is a hardening improvement rather than a fix for an active exploit.
Review the actual diff in the 'lark' submodule to confirm the Ledger API call now sets the display-path flag for non-standard derivation paths. Ensure the definition of 'non-standard path' is documented and tested. No urgent user action is required, but users retrieving xpubs from non-standard paths should verify the path shown on their Ledger screen.
Security signals we found
On-device user confirmation for sensitive key export
Derivation path display to mitigate path confusion
Hardening of hardware wallet xpub retrieval flow
Evidence from the diff
The one-line change in the ‘lark’ file (likely a submodule reference or dependency pointer) updates Ledger device interaction so that path display is requested during xpub retrieval for any non-standard derivation path. Standard paths (e.g., BIP44/49/84/86 account levels) typically do not require on-device confirmation, while non-standard paths now force the user to review the path on the Ledger screen before export. This is a defense-in-depth measure against path confusion attacks where a compromised host might request an xpub from an unexpected derivation path.
Changed components
Ledger hardware wallet integrationxpub export/retrieval flowlark submodule or dependencyInspect captured patch +1 / −1
Diff not available from the source API.Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.