Informational 12 Bitcoin Committed Sep 16, 2026 · 15:15 UTC

test: pin the BIP-48 SignMessage permission surface

f6cf5094 View source ↗

Public commit record

What the developer wrote

Authored by Petr Susil

95/100 · Strong

test: pin the BIP-48 SignMessage permission surface

Add tests covering every BIP-48 path and script type that message signing
accepts or refuses. They record today's behaviour, so later changes show up.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification

The short version

What changed, and why it matters

This commit only adds new automated tests for the Bitcoin message-signing feature on Trezor hardware wallets. It does not change the firmware's actual signing behavior; it records which BIP-48 derivation paths and script types are currently allowed, warned, or refused. The goal is to make any future behavior changes visible in test results. There is no fix or functional code change here.

Recommended action

No action required; this is a test-only commit. Reviewers may want to verify that the recorded expected behavior matches the intended security policy for BIP-48 and SLIP-25 paths.

Security signals we found

Test-only change with no production code modification

Adds regression tests for BIP-48 message signing permission matrix

Records current behavior: account-level BIP-48 paths forbidden, leaf paths warned, legacy level signs as P2PKH

Includes SLIP-25 path that must remain forbidden without unlock path

Technical analysis

Evidence from the diff

The diff adds pytest parametrized test vectors covering BIP-48 (m/48h/0h/0h/{0h,1h,2h}) message-signing paths with SPENDADDRESS, SPENDP2SHWITNESS, and SPENDWITNESS script types, plus a SLIP-25 path that must remain forbidden. It imports TrezorFailure and asserts expected FailureType.DataError for forbidden paths, UnknownDerivationPath warnings for leaf paths, and successful signatures otherwise. UI test fixture hashes are updated for the new test cases. No firmware source code is modified.

Changed components

tests/device_tests/bitcoin/test_signmessage.pytests/ui_tests/fixtures.json

Inspect captured patch +215 / −1

### tests/device_tests/bitcoin/test_signmessage.py
@@ -21,7 +21,7 @@
 from trezorlib import btc, messages
 from trezorlib.debuglink import DebugSession as Session
 from trezorlib.debuglink import LayoutType, message_filters
-from trezorlib.exceptions import Cancelled
+from trezorlib.exceptions import Cancelled, TrezorFailure
 from trezorlib.tools import parse_path
 
 from ...common import is_core
@@ -493,3 +493,157 @@ def test_signmessage_path_warning(session: Session):
             message=message,
             script_type=messages.InputScriptType.SPENDWITNESS,
         )
+
+
+# BIP-48 message signing, see #7717. The whole permission surface, one
+# trezorctl invocation per row:
+#
+#     trezorctl btc sign-message -n "<path>" -t <script type> "hello"
+
+MESSAGE = "This is an example of a signed message."
+
+# Not in the keychain, so refused outright rather than warned about.
+FORBIDDEN = "forbidden"
+# Signs, but shows the unknown derivation path screen first.
+WARN = "warn"
+# Signs with no warning.
+SIGNS = "signs"
+
+
+VECTORS_BIP48_MATRIX = (  # path, script_type, expected
+    # 0h is the legacy-multisig level; message signing is single-key, so it
+    # signs as p2pkh and trezorctl sends SPENDADDRESS rather than SPENDMULTISIG
+    pytest.param("m/48h/0h/0h/0h", S.SPENDADDRESS, FORBIDDEN, id="account_0h-address"),
+    pytest.param(
+        "m/48h/0h/0h/0h", S.SPENDP2SHWITNESS, FORBIDDEN, id="account_0h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/0h", S.SPENDWITNESS, FORBIDDEN, id="account_0h-segwit"),
+    pytest.param("m/48h/0h/0h/0h/0/0", S.SPENDADDRESS, WARN, id="leaf_0h-address"),
+    pytest.param(
+        "m/48h/0h/0h/0h/0/0", S.SPENDP2SHWITNESS, WARN, id="leaf_0h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/0h/0/0", S.SPENDWITNESS, WARN, id="leaf_0h-segwit"),
+    # 1h is the P2SH-segwit level
+    pytest.param("m/48h/0h/0h/1h", S.SPENDADDRESS, FORBIDDEN, id="account_1h-address"),
+    pytest.param(
+        "m/48h/0h/0h/1h", S.SPENDP2SHWITNESS, FORBIDDEN, id="account_1h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/1h", S.SPENDWITNESS, FORBIDDEN, id="account_1h-segwit"),
+    pytest.param("m/48h/0h/0h/1h/0/0", S.SPENDADDRESS, WARN, id="leaf_1h-address"),
+    pytest.param(
+        "m/48h/0h/0h/1h/0/0", S.SPENDP2SHWITNESS, WARN, id="leaf_1h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/1h/0/0", S.SPENDWITNESS, WARN, id="leaf_1h-segwit"),
+    # 2h is the native-segwit level -- the paths reported in #7717
+    pytest.param("m/48h/0h/0h/2h", S.SPENDADDRESS, FORBIDDEN, id="account_2h-address"),
+    pytest.param(
+        "m/48h/0h/0h/2h", S.SPENDP2SHWITNESS, FORBIDDEN, id="account_2h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/2h", S.SPENDWITNESS, FORBIDDEN, id="account_2h-segwit"),
+    pytest.param("m/48h/0h/0h/2h/0/0", S.SPENDADDRESS, WARN, id="leaf_2h-address"),
+    pytest.param(
+        "m/48h/0h/0h/2h/0/0", S.SPENDP2SHWITNESS, WARN, id="leaf_2h-p2shsegwit"
+    ),
+    pytest.param("m/48h/0h/0h/2h/0/0", S.SPENDWITNESS, WARN, id="leaf_2h-segwit"),
+)
+
+LEGACY_LEVEL_EXPECTED = WARN
+
+
+@pytest.mark.parametrize("path, script_type, expected", VECTORS_BIP48_MATRIX)
+def test_signmessage_bip48_matrix(
+    session: Session,
+    path: str,
+    script_type: messages.InputScriptType,
+    expected: str,
+):
+    if expected == FORBIDDEN:
+        with pytest.raises(TrezorFailure, match="Forbidden key path") as exc:
+            btc.sign_message(
+                session,
+                coin_name="Bitcoin",
+                n=parse_path(path),
+                message=MESSAGE,
+                script_type=script_type,
+            )
+        assert exc.value.code is messages.FailureType.DataError
+        return
+
+    expected_responses = []
+    if expected == WARN:
+        expected_responses.append(
+            message_filters.ButtonRequest(
+                code=messages.ButtonRequestType.UnknownDerivationPath
+            )
+        )
+    expected_responses += [
+        message_filters.ButtonRequest(code=messages.ButtonRequestType.Other),
+        message_filters.ButtonRequest(code=messages.ButtonRequestType.Other),
+        messages.MessageSignature,
+    ]
+
+    with session.test_ctx as client:
+        client.set_expected_responses(expected_responses)
+        if is_core(session):
+            IF = InputFlowConfirmAllWarnings(session)
+            client.set_input_flow(IF.get())
+        sig = btc.sign_message(
+            session,
+            coin_name="Bitcoin",
+            n=parse_path(path),
+            message=MESSAGE,
+            script_type=script_type,
+        )
+
+    assert sig.signature
+
+
+def test_signmessage_bip48_legacy_level_signs_as_p2pkh(session: Session):
+    # The path alone reads as SPENDMULTISIG, but there is no multisig message
+    # signature, so trezorctl sends the single-key analogue.
+    from trezorlib.cli.btc import guess_script_type_from_path
+
+    address_n = parse_path("m/48h/0h/0h/0h/0/0")
+    assert guess_script_type_from_path(address_n) is S.SPENDMULTISIG
+
+    expected_responses = []
+    if LEGACY_LEVEL_EXPECTED == WARN:
+        expected_responses.append(
+            message_filters.ButtonRequest(
+                code=messages.ButtonRequestType.UnknownDerivationPath
+            )
+        )
+    expected_responses += [
+        message_filters.ButtonRequest(code=messages.ButtonRequestType.Other),
+        message_filters.ButtonRequest(code=messages.ButtonRequestType.Other),
+        messages.MessageSignature,
+    ]
+
+    with session.test_ctx as client:
+        client.set_expected_responses(expected_responses)
+        if is_core(session):
+            IF = InputFlowConfirmAllWarnings(session)
+            client.set_input_flow(IF.get())
+        sig = btc.sign_message(
+            session,
+            coin_name="Bitcoin",
+            n=address_n,
+            message=MESSAGE,
+            script_type=S.SPENDADDRESS,
+        )
+
+    assert sig.signature
+    assert sig.address.startswith("1")
+
+
+@pytest.mark.models("core")
+def test_signmessage_slip25_requires_unlock_path(session: Session):
+    # The account-node grant must not reach the coinjoin account.
+    with pytest.raises(TrezorFailure, match="Forbidden key path"):
+        btc.sign_message(
+            session,
+            coin_name="Bitcoin",
+            n=parse_path("m/10025h/0h/0h/1h"),
+            message=MESSAGE,
+            script_type=S.SPENDTAPROOT,
+        )

### tests/ui_tests/fixtures.json
@@ -5286,6 +5286,25 @@
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh1]": "a27bc1fdbf51855e89148465ae1b5e8202543e79a59a6b645dd15c9a3839d0ff",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh2]": "0358b55d6de97836d9ad1e96b09c966153b569045e96e01f6fbb696a9e2a2918",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage[t1 firmware path]": "9dd3dbf6b7a778bd878172c5c6c299d67c7d917e1c8abb44457179d43f30e247",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_legacy_level_signs_as_p2pkh": "d718db1240ec38c04116c1d1ec69ca0cde8b7c246ce7191281235df8fe18da2e",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-address]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-p2shsegwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-segwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-address]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-p2shsegwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-segwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-address]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-p2shsegwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-segwit]": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-address]": "d718db1240ec38c04116c1d1ec69ca0cde8b7c246ce7191281235df8fe18da2e",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-p2shsegwit]": "c847bd341415a1b5807db71c32c392d49afa72578d511d2d488243d7d958b5da",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-segwit]": "02b8a1330d1e85334e34cd4985435b959f7ecb220beb99db1c9915ad13f7f85f",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-address]": "f89f8bf7aaf3de4716fefeb990241710554a7e5c45a1bf82c01aebc5180dc854",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-p2shsegwit]": "7aad9861adaf2ad51d547933348379c111a11be585a637899cd218f17a623ea6",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-segwit]": "c8b6e2a0dbba2f26a30c1f7a0eb87dd398623cfc99e2f4b242f14e5152f178d9",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-address]": "ecc54483a701da9077de76688a8bf44944afcc8f1aa120cf79fedaf69ed85e9e",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-p2shsegwit]": "1c3b7f5af20cd2213f3d62a8388825d7f4c7bf330565b23ebecbf7eebb42a328",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-segwit]": "f21039d2440928c01e72a8d7ac2ebf71163b9948637f8b5a748490009fbf4719",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_info[NFC message]": "dd603061d6e4229c752eb6b40a5bf6462e76902939e5ca2fcd7a01e4f372a931",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_info[NFKD message]": "dd603061d6e4229c752eb6b40a5bf6462e76902939e5ca2fcd7a01e4f372a931",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_info[bcash]": "cffcc2682c249513e4adc44852ffa02cdabdc336864300ed599f5e7f143cbe78",
@@ -5316,6 +5335,7 @@
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_pagination[utf_text]": "7807779018771100ca90296a8cf8cf0cd73d87ed52a7efe26060b7df233d7cce",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_pagination_trailing_newline": "c1afe849ef2467f87530efc37fc5711d403ab06e54e028eaa653a73f590a8d31",
 "T2T1_en_bitcoin-test_signmessage.py::test_signmessage_path_warning": "8b9e052540ade46233859096c065dd6a64a64eb536f4a203e8111af6621fbc09",
+"T2T1_en_bitcoin-test_signmessage.py::test_signmessage_slip25_requires_unlock_path": "8aa7c68cd09e700e8c6903dcfc39c4a66214481c12c34dc56762829478399b79",
 "T2T1_en_bitcoin-test_signtx.py::test_attack_change_input_address": "250f6ddf7f7800cb264b4eff2e5d36a540bffb1e7a4d77a02f359f8572477cb8",
 "T2T1_en_bitcoin-test_signtx.py::test_attack_change_outputs": "44c56da502700444709be4a35cda964b64493a433bc36eaa6943a1d55c2b3bb8",
 "T2T1_en_bitcoin-test_signtx.py::test_attack_modify_change_address": "64efa1aa668eb4c0b992dc1c15456d12e6c431a01856f59b1f8e1a53cb2b0221",
@@ -18706,6 +18726,25 @@
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh1]": "bfec5057b41a54982b132a9d4e0e9da4598ba1505948903e06b7bdcf7420784e",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh2]": "e9267f7c5fd6b49ee094a2edebd61a01c21da6d94514a037985eebb2f1a6fc95",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage[t1 firmware path]": "2ecf5031f6001e87227fa938d61c946fce4146754cb22106cd2404f282d62bd6",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_legacy_level_signs_as_p2pkh": "a7d1b33b525777ab457d8d85a5f3861fd35f52f122874f6daea5b20f80f1852e",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-address]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-p2shsegwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-segwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-address]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-p2shsegwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-segwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-address]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-p2shsegwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-segwit]": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-address]": "a7d1b33b525777ab457d8d85a5f3861fd35f52f122874f6daea5b20f80f1852e",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-p2shsegwit]": "c9ce28a79fb8fcc014aee8c1e54795f07b9f2f3b9678db5a4faf853d9f372651",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-segwit]": "147b493bc75e19b7cdf730b14d24c660f4991aeef2e854f346f92a265d6bac34",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-address]": "e458a1cab9cea4c31a9787ed3f610507a3c6880715e209210ec862eaacb9fe32",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-p2shsegwit]": "3aca71785aaca1f9df3d4865e255c89b83c6a186c7e64cb5896b8046fc2f0974",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-segwit]": "c20b9b4ad77d79af5a500302d7209886fddbd3302eb96de58728f6361379ffc1",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-address]": "08a72390ebd0266b82d61d1149fd21f77b6b1e56648e11d45c01ba37cc72fd73",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-p2shsegwit]": "ec11b9f69a81da91cff13d29db768d795af5fbf645f42ba105e25dfcb763b126",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-segwit]": "62be892e512d3db592493ea366568ee53e8441a8a2593be40132efa78ecc801e",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_long[p2pkh long message]": "6043c294549d7b555f4d7b037a42fccc75c5e235749af5671a7603c735245ad0",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_long[segwit-native long message]": "b370623d9627e9a0938f8f7bec76d6d39cd8e3bb78947a1771b5ecbe808a7fd7",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_long[segwit-p2sh long message]": "25ae2b69314acace829d302d29d1591bb766419a81d65917739dde5c0a551f16",
@@ -18717,6 +18756,7 @@
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_pagination[utf_nospace]": "e16d5e745da692febd8053075e2df80744e2140b0b2e90a20b5b29f50f0bca99",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_pagination[utf_text]": "da456f5a8a6b8a9ca146b855a273605094d3ca9f12ca89a1bb5474741caf7175",
 "T3B1_en_bitcoin-test_signmessage.py::test_signmessage_path_warning": "45c58f5b6c999210f7d6bd087fd93b743700590835184c40009630acc5c3de12",
+"T3B1_en_bitcoin-test_signmessage.py::test_signmessage_slip25_requires_unlock_path": "7945fdf0623a34efada654fe62a57fa06c6ab0cf4383bc14c6b7acd594b10596",
 "T3B1_en_bitcoin-test_signtx.py::test_attack_change_input_address": "cbb2413a43d14e8b372af13f1eac59c91b42e8d1c9a64c5e0cf62f261caf9edb",
 "T3B1_en_bitcoin-test_signtx.py::test_attack_change_outputs": "6cf5baaaed32b7568ff175c46327d399257b08e603dac1eb2ab057d11817416a",
 "T3B1_en_bitcoin-test_signtx.py::test_attack_modify_change_address": "af94789cd9c24d49aed038af832335a1ca8bceaeaf92690b4a5c0e747a08bcaf",
@@ -45815,6 +45855,25 @@
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh1]": "9c636c5ec4273ecd63958eb0c39ad2a2b511c49e17376d30da69a353bdd6140c",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage[segwit-p2sh2]": "9241d960d217fc6cae4a273e48c030212582d9a7fbce519cf75b859b75d2318a",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage[t1 firmware path]": "6e85d7209c5be1d8c3a911b23a98b81ba850be0f27a855ed1b092084dfbc2daf",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_legacy_level_signs_as_p2pkh": "f9763b07e3f5931100cdad6e9d7986d7de53556cc79ac743f184515729d86e10",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-address]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-p2shsegwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_0h-segwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-address]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-p2shsegwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_1h-segwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-address]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-p2shsegwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[account_2h-segwit]": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-address]": "f9763b07e3f5931100cdad6e9d7986d7de53556cc79ac743f184515729d86e10",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-p2shsegwit]": "f364251b659d2699867edc025e439f0ecf9a462981c055c76b8cf41e1195efe4",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_0h-segwit]": "80d7ba33bc1d69327edd3a7ac1a6a5010bb183c26742d05b00cbfb9e08fd61e3",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-address]": "0135d168d6b5b68e63149a5ba1e989fc493d2c0ada904bc68b5f3dc294191916",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-p2shsegwit]": "88c96c855ecfe04ee182beb8816615cb57b4d5a45581d26b2f66e0c26cfd0cc3",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_1h-segwit]": "2921c1cedf930dcef14feee96c3aff841268ba902e6e2a2aabcad7a803277ccc",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-address]": "3fee9933435d0968f5c29ab78a81ea510ae367cf76217c48827d8ae2fac4330f",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-p2shsegwit]": "a5aee156bf7db16530f9b933aa42e898ba6fe40db98ca08d49bd0d5ec9db314d",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_bip48_matrix[leaf_2h-segwit]": "7dd72f11e37fb1ff936364d5e032a1c98a25078bb88e8d7fd5082be353b07676",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_info[NFC message]": "c99fee2d9666a30157f3e9a1f9253580541dae8db70e7d4e74d26f310ac2b95e",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_info[NFKD message]": "c99fee2d9666a30157f3e9a1f9253580541dae8db70e7d4e74d26f310ac2b95e",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_info[bcash]": "3e2e25e0a96f7c730d7cd6aa074ce8799122c7b97019bfd39e5f50bdfdb8bf96",
@@ -45842,6 +45901,7 @@
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_pagination_eckhart[utf_nospace]": "2132de779d07e7ae2c459cc09b412f8d36b4591439133f2594eeee6fd7eb7443",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_pagination_eckhart[utf_text]": "82cba40195c60af685c2de574b5bdbb0ee1c313cd6db426973017d5e402398dc",
 "T3W1_en_bitcoin-test_signmessage.py::test_signmessage_path_warning": "3d83b377a131bcfce594a40986d8352f78e5ccba7bfd9e57193edd640a66af00",
+"T3W1_en_bitcoin-test_signmessage.py::test_signmessage_slip25_requires_unlock_path": "90812f196e8c35dc7f35cb5a9a0e553c8fc6a610812d85b9f166e90b3f1c8b59",
 "T3W1_en_bitcoin-test_signtx.py::test_attack_change_input_address": "015509593d81db8a453d5f2800bac555a0e427cf2002dcf8d6fd6ae3e957500a",
 "T3W1_en_bitcoin-test_signtx.py::test_attack_change_outputs": "36ecfa59130cb7c643dff73acc7ba83ac6f08bc171f20b6bba3d00ce6d4633ca",
 "T3W1_en_bitcoin-test_signtx.py::test_attack_modify_change_address": "070d30a8379c6d6ca7e410050b56eb4e1ea3e7981c858556e75befcad51dd49b",

Risk score

Why this scored 12/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 12/100

Community notes

Related watches

docs: document fix_version usage

build(core): rename build-xtask/ to build/

ci: hw: run the permission debugging script even if uhubctl fails