Blockstream Jade

This commit changes how Blockstream Jade handles the 'genesis blockhash' when signing Liquid transactions. Previously, the device only accepted the network's built-in genesis hash. Now it lets users provide a custom genesis hash for test networks (like regtest), but blocks attempts to use the real Liquid mainnet genesis hash on test networks to prevent spoofing. The change also applies the same validation to both PSBT/PSET signing and raw transaction signing. It appears to be a hardening/feature addition rather than a fix for an active exploit, but it does close a spoofing path on test networks.

This commit is a simple rename of two internal helper functions from `rpc_get_boolean`/`rpc_get_boolean_or` to `rpc_get_bool`/`rpc_get_bool_or`, updating all call sites accordingly. There is no change to what the code does, no bug fix, and no security relevance.

This commit is a straightforward code cleanup that replaces verbose 'read this optional value, or leave the default' patterns with shorter helper functions that do the same thing. There is no change in behavior and no security issue visible in the diff.

This commit is a preventive build-hardening change. It adds compiler annotations (WARN_UNUSED_RESULT) to many functions that return success/failure codes, so the compiler will warn if a caller ignores the result. The goal is to catch future bugs where an error return is silently dropped, but the commit itself does not fix any specific known bug or change runtime behavior.

This commit fixes a small but meaningful bug in how Jade, a hardware wallet, reads key paths from Bitcoin PSBT data. The code was passing the byte size of a buffer when it should have passed the number of 32-bit entries. Depending on how the underlying library interprets that value, this could lead to reading truncated paths, rejecting valid transactions, or possibly reading past the intended buffer. It is a defensive fix in security-sensitive parsing code, but the commit itself does not claim a specific exploitable vulnerability.

This commit fixes a bug in the Blockstream Jade hardware wallet's PSBT (Partially Signed Bitcoin Transaction) signing code. Previously, when the transaction's genesis block hash did not match the expected network, the code set an error message but accidentally continued processing instead of stopping. This one-line fix adds the missing 'return' so the device rejects mismatched transactions immediately. Without the fix, a user could potentially be tricked into signing a transaction on the wrong network, which might lead to loss of funds or confusion between mainnet and testnet/signet assets.

This commit fixes a bug in the PIN-change flow on Blockstream Jade hardware wallets. Previously, if re-encrypting the wallet keys with a new PIN failed, or if the user abandoned the PIN change, the code did not jump to cleanup as intended. Instead, it could fall through and continue executing subsequent code paths that were meant to be skipped. This could lead to incorrect state handling, potential use of stale or invalid key material, or confusing behavior after a failed PIN change. The fix adds explicit 'goto cleanup' statements so the function exits the sensitive section safely in both error and abandonment cases.

This commit fixes a small but real bug in the device attestation setup code for Blockstream Jade, a hardware crypto wallet. When a one-time programmable security fuse failed to burn, the code used to exit immediately without releasing memory or undoing earlier setup steps. The fix makes it jump to a cleanup routine instead. The direct risk is mainly a resource leak or partial initialization state on a rare hardware failure, not an obvious remote attack.

This commit fixes a bug in the Blockstream Jade hardware wallet's attestation signing process. Previously, if signing the attestation challenge failed, the device would send an error message but then continue running the rest of the function anyway, potentially sending an invalid or uninitialized reply back to the caller. The fix ensures the function stops immediately after reporting the error.

This commit fixes a bug in the Blockstream Jade hardware wallet where a function that tracks assets during transaction signing could fail silently. Previously, if an unexpected or wrong asset was encountered while building a summary of transaction inputs and outputs, the wallet ignored the failure and continued signing. The patch now checks the function's return value and aborts signing with an error. This could have allowed a malicious or malformed transaction to bypass the wallet's balance checks, potentially misleading the user about what assets were actually being moved.

This commit reworks how a Blockstream Jade hardware wallet labels transaction outputs. The key change is that the 'change' flag is now only set when the output is also confirmed as belonging to the wallet ('is ours'). Previously, downstream code had to check both 'validated' and 'change' bits to safely hide a change output; now it can rely on the 'change' bit alone. The commit also renames the flag from VALIDATED to IS_OURS and adds comments. The stated intent is to prevent a change output from being marked as change unless it is also confirmed as a wallet output, which could reduce the risk of an attacker tricking the device into hiding a payment to an external address.

This is a large update that pulls in Espressif's ESP-IDF v5.5.4 bootloader code, plus Blockstream's own multi-signature secure-boot patches. Most of the visible changes are routine: support for newer ESP32 chips, larger flash sizes, and a new Trusted Execution Environment (TEE) mode. There are also several security-hardening touches, such as preventing the TEE from writing or erasing its own active flash partition and adding anti-fault-injection checks. However, the commit is a broad vendor SDK refresh rather than a single focused security fix, and the diff provided is only a partial sample of the whole change.

This update fixes a security gap in how Blockstream Jade signs Bitcoin transactions for a specific wallet type called Green 2of3. Previously, the device trusted the connected app to supply a recovery public key and might silently treat an output as 'change' going back to the user's own wallet. A malicious or compromised companion app could have supplied a fake recovery key, tricking the device into marking a payment to an attacker's address as safe internal change. The fix forces the user to manually verify such outputs on the device screen instead of trusting the app, matching the behavior already used for PSBT signing.

This commit is a straightforward code cleanup. It replaces a verbose way of showing on-screen messages and errors with simpler helper functions, and fixes a spelling mistake ('re-encypt' to 're-encrypt'). There is no change to security logic, no bug fix, and no vulnerability addressed.

This commit changes how message context is passed between functions in the Blockstream Jade hardware wallet firmware. Instead of copying the entire message context structure on the stack, functions now receive a pointer to it. The stated goal is to reduce stack memory usage. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but reducing stack pressure can help prevent stack overflow crashes or corruption in a security-critical embedded device.

This commit adds a new device command that lets a connected computer or phone ask a Blockstream Jade hardware wallet to display an encrypted BIP85 seed-entropy backup as a QR code. The change also tightens validation of the BIP32 index in several places, fixing a place where an out-of-range index was accepted. There is no direct evidence in the diff of a vulnerability being exploited, but the new QR-display path and the tightened validation are security-relevant.

This commit changes the logic in Blockstream Jade's PSBT signing flow so that, when the hardware wallet is acting as a 'recovery' key for a Green 2-of-3 wallet, it always asks the user to confirm outputs that belong to Green, rather than silently trusting them. Previously, the code skipped confirmation if Jade detected it was the recovery key and the output matched a Green script. The change flips the condition: now, if Jade is the recovery key OR the script does not match Green's expected pattern, the output must be confirmed. This is a defensive fix to prevent a compromised companion app or host from sneaking an unverified output past the user during recovery signing.