fix(core): monero key image sync error message
What the developer wrote
Authored by Martin Milata
fix(core): monero key image sync error message
[no changelog]
What changed, and why it matters
This commit fixes a misleading error message in the Monero key image sync feature on Trezor hardware wallets. Previously, when the cryptographic hash check failed, the device incorrectly reported 'Invalid number of outputs' instead of 'Invalid hash'. This is a user-facing string correction with no direct security vulnerability in the underlying check itself.
No security action required beyond normal review; the change is cosmetic/diagnostic. Consider whether other Monero modules have similarly mismatched error messages as part of routine code quality review.
Security signals we found
Incorrect error message could impede debugging or mislead users/developers about failure cause
No change to cryptographic validation logic
Evidence from the diff
In core/src/apps/monero/key_image_sync.py, the final integrity check compares final_hash against state.expected_hash. The original code raised DataError(‘Invalid number of outputs’) for a hash mismatch, which is semantically wrong. The patch changes the exception message to DataError(‘Invalid hash’). The validation logic (hash comparison) remains unchanged; only the diagnostic message is corrected.
Changed components
core/src/apps/monero/key_image_sync.pyInspect captured patch +1 / −1
diff --git a/core/src/apps/monero/key_image_sync.py b/core/src/apps/monero/key_image_sync.py
index b852b3f4..b107be98 100644
--- a/core/src/apps/monero/key_image_sync.py
+++ b/core/src/apps/monero/key_image_sync.py
@@ -48,7 +48,7 @@ async def key_image_sync(
raise DataError("Invalid number of outputs")
final_hash = state.hasher.digest()
if final_hash != state.expected_hash:
- raise DataError("Invalid number of outputs")
+ raise DataError("Invalid hash")
return MoneroKeyImageSyncFinalAck(enc_key=state.enc_key)
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.