fix(core): fix testing Optiga certificates

Trezor/Trezor firmware

360decd3 View source ↗

Public commit record

What the developer wrote

Authored by Ondřej Vejpustek

67/100 · Adequate

fix(core): fix testing Optiga certificates

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body

The short version

What changed, and why it matters

This commit updates test-only digital certificates used in Trezor firmware emulators for the T3W1 model. It does not change production device code. The certificates are part of the emulator's simulated secure chip environment and are not shipped to real hardware wallets. The change appears to be a maintenance fix to make emulator tests work with a customized test Hardware Security Module (HSM).

Recommended action

No immediate action required. Treat as routine test infrastructure maintenance. If reviewing supply chain security, verify that the regenerated test certificates are not used in production builds and that the disclosed test root private key is not used for real device certificates.

Security signals we found

Certificate regeneration in test-only emulator path

README documents use of a customized test HSM with a disclosed root private key

No production firmware code or real device certificate store is modified

No changelog entry suggests routine/internal testing fix

Technical analysis

Evidence from the diff

The commit replaces the T3W1.der binary certificate and its corresponding T3W1.h C header array under core/embed/sec/optiga/unix/certs/. These files are used only in the Unix emulator build for the Optiga secure element simulation. The README update explains that T3W1 test certificates were regenerated using a customized HSM with a specific P-256 root private key and updates the generation tool reference from gen.sh to core/tools/generate_certificates.py. The certificate chain structure, validity dates, serial numbers, public keys, and signatures all changed, consistent with a full certificate regeneration rather than a code vulnerability fix.

Changed components

core/embed/sec/optiga/unix/certs/T3W1.dercore/embed/sec/optiga/unix/certs/T3W1.hcore/embed/sec/optiga/unix/certs/README.md

Inspect captured patch +80 / −71

diff --git a/core/embed/sec/optiga/unix/certs/README.md b/core/embed/sec/optiga/unix/certs/README.md
index 888da702..e38e0a6b 100644
--- a/core/embed/sec/optiga/unix/certs/README.md
+++ b/core/embed/sec/optiga/unix/certs/README.md
@@ -1,7 +1,10 @@
 # Certificate chains for emulators
 
 The DER files are generated by asking the staging HSM for the given model, to sign
-a certificate for a private key `01000000...`.
+a certificate for a private key `01000000...`. T3W1 certificates were generated
+using a customized HSM that uses `79facff8541a656e140bc47ae106aa6f9ac7d12c41f29aae5bd966e0896cdcc3`
+as the root P-256 private key.
+
 
 When you add a new certificate, please add it to the `certs` directory and generate
-the header with `gen.sh` (using `xxd` to convert bytes into a C array).
+the header with `core/tools/generate_certificates.py`.
diff --git a/core/embed/sec/optiga/unix/certs/T3W1.der b/core/embed/sec/optiga/unix/certs/T3W1.der
index 167f1d3d..86f64e3a 100644
Binary files a/core/embed/sec/optiga/unix/certs/T3W1.der and b/core/embed/sec/optiga/unix/certs/T3W1.der differ
diff --git a/core/embed/sec/optiga/unix/certs/T3W1.h b/core/embed/sec/optiga/unix/certs/T3W1.h
index 9e433cdd..cdac1772 100644
--- a/core/embed/sec/optiga/unix/certs/T3W1.h
+++ b/core/embed/sec/optiga/unix/certs/T3W1.h
@@ -4,8 +4,8 @@
 
 #define OPTIGA_DEVICE_CERT_CHAIN                                              \
   {                                                                           \
-      0x30, 0x82, 0x01, 0xa3, 0x30, 0x82, 0x01, 0x49, 0xa0, 0x03, 0x02, 0x01, \
-      0x02, 0x02, 0x04, 0x21, 0xa6, 0x48, 0xa1, 0x30, 0x0a, 0x06, 0x08, 0x2a, \
+      0x30, 0x82, 0x01, 0xca, 0x30, 0x82, 0x01, 0x6f, 0xa0, 0x03, 0x02, 0x01, \
+      0x02, 0x02, 0x04, 0x4a, 0x25, 0xea, 0x17, 0x30, 0x0a, 0x06, 0x08, 0x2a, \
       0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x4f, 0x31, 0x0b, 0x30, \
       0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, \
       0x30, 0x1c, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, \
@@ -13,71 +13,77 @@
       0x73, 0x2e, 0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, \
       0x55, 0x04, 0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, \
       0x4d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, \
-      0x67, 0x20, 0x43, 0x41, 0x30, 0x22, 0x18, 0x0f, 0x32, 0x30, 0x32, 0x35, \
-      0x30, 0x34, 0x31, 0x30, 0x31, 0x31, 0x34, 0x30, 0x35, 0x30, 0x5a, 0x18, \
-      0x0f, 0x32, 0x30, 0x35, 0x35, 0x30, 0x34, 0x30, 0x33, 0x31, 0x31, 0x34, \
-      0x30, 0x35, 0x30, 0x5a, 0x30, 0x1d, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, \
-      0x55, 0x04, 0x03, 0x0c, 0x12, 0x54, 0x33, 0x57, 0x31, 0x20, 0x54, 0x72, \
-      0x65, 0x7a, 0x6f, 0x72, 0x20, 0x53, 0x61, 0x66, 0x65, 0x20, 0x37, 0x30, \
-      0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, \
-      0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, \
-      0x00, 0x04, 0x9b, 0xbf, 0x06, 0xda, 0xd9, 0xab, 0x59, 0x05, 0xe0, 0x54, \
-      0x71, 0xce, 0x16, 0xd5, 0x22, 0x2c, 0x89, 0xc2, 0xca, 0xa3, 0x9f, 0x26, \
-      0x26, 0x7a, 0xc0, 0x74, 0x71, 0x29, 0x88, 0x5f, 0xbd, 0x44, 0x1b, 0xcc, \
-      0x7f, 0xa8, 0x4d, 0xe1, 0x20, 0xa3, 0x67, 0x55, 0xda, 0xf3, 0x0a, 0x6f, \
-      0x47, 0xe8, 0xc0, 0xd4, 0xbd, 0xdc, 0x15, 0x03, 0x6e, 0xd2, 0xa3, 0x44, \
-      0x7d, 0xfa, 0x7a, 0x1d, 0x3e, 0x88, 0xa3, 0x41, 0x30, 0x3f, 0x30, 0x0e, \
-      0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, \
-      0x00, 0x80, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, \
-      0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, \
-      0x18, 0x30, 0x16, 0x80, 0x14, 0x93, 0xe0, 0xf9, 0x2e, 0x12, 0x66, 0x94, \
-      0xaf, 0xf3, 0x7f, 0x70, 0xb5, 0xbb, 0xf4, 0x69, 0x57, 0xcb, 0xbe, 0xe2, \
-      0xcb, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, \
-      0x02, 0x03, 0x48, 0x00, 0x30, 0x45, 0x02, 0x21, 0x00, 0xab, 0x04, 0x22, \
-      0x1e, 0xba, 0x8c, 0x64, 0x71, 0xee, 0x5a, 0xbc, 0x76, 0xfe, 0x84, 0x93, \
-      0x94, 0xac, 0xdc, 0x6a, 0x5e, 0xa5, 0x32, 0x65, 0xd5, 0x6e, 0x74, 0x41, \
-      0x30, 0x0c, 0xdd, 0xba, 0xe7, 0x02, 0x20, 0x38, 0x35, 0x75, 0x58, 0x6d, \
-      0x63, 0x7b, 0xd6, 0x12, 0xcb, 0x16, 0x5d, 0x3f, 0xae, 0x7d, 0x6c, 0xda, \
-      0xba, 0x09, 0x1d, 0x31, 0x9d, 0x45, 0x9c, 0x60, 0x7e, 0xaa, 0x1a, 0x18, \
-      0x8f, 0x8c, 0xcc, 0x30, 0x82, 0x01, 0xe2, 0x30, 0x82, 0x01, 0x88, 0xa0, \
-      0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x67, 0xf7, 0xad, 0xbe, 0x2c, 0x29, \
-      0x29, 0xdc, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, \
-      0x03, 0x02, 0x30, 0x54, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, \
-      0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, \
-      0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x43, \
-      0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, 0x72, 0x2e, 0x6f, \
-      0x2e, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x1c, \
-      0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x75, 0x66, \
-      0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x52, 0x6f, 0x6f, \
-      0x74, 0x20, 0x43, 0x41, 0x30, 0x20, 0x17, 0x0d, 0x32, 0x35, 0x30, 0x34, \
-      0x31, 0x30, 0x31, 0x31, 0x33, 0x38, 0x33, 0x38, 0x5a, 0x18, 0x0f, 0x32, \
-      0x30, 0x35, 0x35, 0x30, 0x34, 0x31, 0x30, 0x31, 0x31, 0x33, 0x38, 0x33, \
-      0x38, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, \
-      0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, 0x06, 0x03, 0x55, \
-      0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x43, \
-      0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, 0x72, 0x2e, 0x6f, \
-      0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x17, \
-      0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, 0x6e, 0x75, 0x66, \
-      0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, 0x43, 0x41, 0x30, \
-      0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, \
-      0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x03, 0x42, \
-      0x00, 0x04, 0xa5, 0xd7, 0x01, 0xfc, 0xed, 0x9b, 0x5a, 0x2c, 0xd0, 0x76, \
-      0xa0, 0x2d, 0x8a, 0x98, 0xe7, 0x79, 0xc5, 0x49, 0x46, 0xee, 0xfc, 0x7b, \
-      0x25, 0x25, 0xfa, 0xc7, 0x82, 0xfa, 0x3d, 0x65, 0xb5, 0xd9, 0xe6, 0xa8, \
-      0xc9, 0x09, 0x46, 0xbd, 0x30, 0xb3, 0x5d, 0xfe, 0xec, 0x34, 0xa0, 0x53, \
-      0xf1, 0x10, 0x6b, 0xa1, 0x30, 0xa8, 0x47, 0x20, 0x37, 0xf2, 0xdb, 0x8c, \
-      0xf2, 0xc4, 0xb3, 0xb6, 0xe9, 0x3a, 0xa3, 0x47, 0x30, 0x45, 0x30, 0x0e, \
-      0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, 0x03, 0x02, \
-      0x02, 0x04, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, \
-      0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x00, 0x30, 0x1f, \
-      0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x37, \
-      0x41, 0x8f, 0x47, 0xc1, 0x47, 0x4c, 0x2b, 0xea, 0x90, 0x70, 0xcc, 0x92, \
-      0x54, 0x18, 0x63, 0x3b, 0xdb, 0x8d, 0xa1, 0x30, 0x0a, 0x06, 0x08, 0x2a, \
-      0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x48, 0x00, 0x30, 0x45, \
-      0x02, 0x20, 0x61, 0x62, 0xac, 0x65, 0x78, 0xe7, 0xa0, 0xaf, 0x97, 0x7e, \
-      0x5b, 0xfc, 0xe1, 0x82, 0x78, 0xf3, 0xa7, 0x62, 0x38, 0xb2, 0x7c, 0x00, \
-      0x75, 0x15, 0x38, 0x67, 0xbb, 0xed, 0x15, 0x6c, 0x70, 0x0f, 0x02, 0x21, \
-      0x00, 0xfe, 0x9a, 0x8d, 0x98, 0x6d, 0xe1, 0x36, 0x7e, 0xdd, 0x12, 0x3a, \
-      0x3a, 0x63, 0xfd, 0xc4, 0x16, 0x7e, 0x1d, 0xce, 0x97, 0x9d, 0xc5, 0x01, \
-      0x93, 0x9f, 0xb7, 0x17, 0x23, 0xe7, 0xcf, 0x2f, 0x6f,                   \
+      0x67, 0x20, 0x43, 0x41, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x35, 0x30, 0x34, \
+      0x31, 0x37, 0x31, 0x36, 0x34, 0x35, 0x33, 0x34, 0x5a, 0x17, 0x0d, 0x34, \
+      0x35, 0x30, 0x34, 0x31, 0x37, 0x31, 0x36, 0x34, 0x35, 0x33, 0x34, 0x5a, \
+      0x30, 0x47, 0x31, 0x1b, 0x30, 0x19, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, \
+      0x12, 0x54, 0x33, 0x57, 0x31, 0x20, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, \
+      0x20, 0x53, 0x61, 0x66, 0x65, 0x20, 0x37, 0x31, 0x17, 0x30, 0x15, 0x06, \
+      0x03, 0x55, 0x04, 0x05, 0x13, 0x0e, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, \
+      0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33, 0x34, 0x31, 0x0f, 0x30, 0x0d, \
+      0x06, 0x03, 0x55, 0x04, 0x2e, 0x13, 0x06, 0x4f, 0x70, 0x74, 0x69, 0x67, \
+      0x61, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, \
+      0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, \
+      0x03, 0x42, 0x00, 0x04, 0x9b, 0xbf, 0x06, 0xda, 0xd9, 0xab, 0x59, 0x05, \
+      0xe0, 0x54, 0x71, 0xce, 0x16, 0xd5, 0x22, 0x2c, 0x89, 0xc2, 0xca, 0xa3, \
+      0x9f, 0x26, 0x26, 0x7a, 0xc0, 0x74, 0x71, 0x29, 0x88, 0x5f, 0xbd, 0x44, \
+      0x1b, 0xcc, 0x7f, 0xa8, 0x4d, 0xe1, 0x20, 0xa3, 0x67, 0x55, 0xda, 0xf3, \
+      0x0a, 0x6f, 0x47, 0xe8, 0xc0, 0xd4, 0xbd, 0xdc, 0x15, 0x03, 0x6e, 0xd2, \
+      0xa3, 0x44, 0x7d, 0xfa, 0x7a, 0x1d, 0x3e, 0x88, 0xa3, 0x41, 0x30, 0x3f, \
+      0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, 0x04, \
+      0x03, 0x02, 0x00, 0x80, 0x30, 0x0c, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, \
+      0x01, 0xff, 0x04, 0x02, 0x30, 0x00, 0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, \
+      0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0x38, 0x15, 0x95, 0xe7, 0x9f, \
+      0x6e, 0x83, 0xc6, 0xa2, 0x93, 0x41, 0xe0, 0xce, 0x9b, 0xab, 0x09, 0xdc, \
+      0xf5, 0x45, 0xff, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, \
+      0x04, 0x03, 0x02, 0x03, 0x49, 0x00, 0x30, 0x46, 0x02, 0x21, 0x00, 0x86, \
+      0xc2, 0x19, 0xcb, 0xee, 0xcc, 0x09, 0x6b, 0x36, 0xd7, 0x0e, 0x2f, 0x64, \
+      0x84, 0x92, 0x9d, 0xa4, 0xaa, 0xc1, 0x50, 0x58, 0x99, 0x8b, 0xc8, 0xc0, \
+      0x98, 0x83, 0x04, 0x27, 0x06, 0xb2, 0x65, 0x02, 0x21, 0x00, 0xcd, 0x23, \
+      0x10, 0x7b, 0xb5, 0xfa, 0xb3, 0x71, 0x17, 0x7e, 0xb3, 0x98, 0x44, 0x6c, \
+      0x2b, 0xf6, 0x7d, 0xf4, 0xe7, 0xd0, 0x43, 0x17, 0x4c, 0x65, 0x6d, 0xfc, \
+      0x25, 0xc8, 0xb2, 0xcd, 0xa4, 0x9d, 0x30, 0x82, 0x02, 0x00, 0x30, 0x82, \
+      0x01, 0xa7, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x08, 0x6a, 0x19, 0x89, \
+      0x7c, 0x3e, 0xf7, 0x01, 0x7e, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, \
+      0xce, 0x3d, 0x04, 0x03, 0x02, 0x30, 0x54, 0x31, 0x0b, 0x30, 0x09, 0x06, \
+      0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, \
+      0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, \
+      0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, \
+      0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x25, 0x30, 0x23, 0x06, 0x03, 0x55, 0x04, \
+      0x03, 0x0c, 0x1c, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, \
+      0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, \
+      0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x30, 0x20, 0x17, 0x0d, 0x32, \
+      0x36, 0x30, 0x35, 0x32, 0x39, 0x31, 0x32, 0x34, 0x31, 0x33, 0x33, 0x5a, \
+      0x18, 0x0f, 0x32, 0x30, 0x35, 0x36, 0x30, 0x35, 0x32, 0x39, 0x31, 0x32, \
+      0x34, 0x31, 0x33, 0x33, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09, 0x06, \
+      0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x43, 0x5a, 0x31, 0x1e, 0x30, 0x1c, \
+      0x06, 0x03, 0x55, 0x04, 0x0a, 0x0c, 0x15, 0x54, 0x72, 0x65, 0x7a, 0x6f, \
+      0x72, 0x20, 0x43, 0x6f, 0x6d, 0x70, 0x61, 0x6e, 0x79, 0x20, 0x73, 0x2e, \
+      0x72, 0x2e, 0x6f, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, \
+      0x03, 0x0c, 0x17, 0x54, 0x72, 0x65, 0x7a, 0x6f, 0x72, 0x20, 0x4d, 0x61, \
+      0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x20, \
+      0x43, 0x41, 0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, \
+      0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, \
+      0x07, 0x03, 0x42, 0x00, 0x04, 0x65, 0xbb, 0x1c, 0x43, 0xe2, 0x46, 0x6c, \
+      0x67, 0x23, 0x48, 0x4e, 0x4d, 0x32, 0xba, 0x10, 0x47, 0xf1, 0xab, 0xe4, \
+      0x85, 0xf6, 0x32, 0x5f, 0x0e, 0x02, 0x1d, 0x55, 0xc0, 0x0a, 0xe2, 0x01, \
+      0x81, 0x05, 0xea, 0x0f, 0x52, 0xcd, 0x69, 0x92, 0xfc, 0xcb, 0xd9, 0x2c, \
+      0x58, 0xdc, 0x7a, 0xa6, 0x50, 0xa8, 0x1b, 0x3b, 0xea, 0x1d, 0xce, 0x11, \
+      0xdd, 0x0d, 0x9f, 0x0f, 0x33, 0xdb, 0x16, 0x78, 0xe7, 0xa3, 0x66, 0x30, \
+      0x64, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x1d, 0x0f, 0x01, 0x01, 0xff, 0x04, \
+      0x04, 0x03, 0x02, 0x02, 0x04, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, \
+      0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, \
+      0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e, 0x04, 0x16, 0x04, 0x14, \
+      0x38, 0x15, 0x95, 0xe7, 0x9f, 0x6e, 0x83, 0xc6, 0xa2, 0x93, 0x41, 0xe0, \
+      0xce, 0x9b, 0xab, 0x09, 0xdc, 0xf5, 0x45, 0xff, 0x30, 0x1f, 0x06, 0x03, \
+      0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80, 0x14, 0xd2, 0x38, 0xcb, \
+      0xfb, 0xb7, 0xd8, 0xab, 0xee, 0x26, 0xca, 0x09, 0xac, 0x71, 0xc6, 0xb5, \
+      0xe4, 0x27, 0xde, 0x9c, 0xdc, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, \
+      0xce, 0x3d, 0x04, 0x03, 0x02, 0x03, 0x47, 0x00, 0x30, 0x44, 0x02, 0x20, \
+      0x7e, 0x1a, 0x61, 0x8b, 0xaf, 0xee, 0x08, 0x86, 0xc3, 0x79, 0xc0, 0x43, \
+      0x4f, 0xf3, 0xb9, 0xa5, 0xbf, 0xe3, 0xf0, 0x23, 0xf7, 0xfb, 0x72, 0x92, \
+      0x4d, 0x61, 0xc1, 0x7c, 0x1d, 0xb8, 0x22, 0x1d, 0x02, 0x20, 0x31, 0xec, \
+      0x01, 0x90, 0xb8, 0x09, 0xf3, 0xf8, 0x83, 0x58, 0x82, 0x44, 0xa2, 0x80, \
+      0x5e, 0x5d, 0x56, 0xff, 0x0d, 0x3d, 0xc1, 0x9f, 0x00, 0x84, 0x42, 0xbb, \
+      0xe9, 0xa8, 0x43, 0x85, 0xc7, 0x72,                                     \
   }

Risk score

Why this scored 16/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 2/15

Confidence 7/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 16/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW