KX
← All projectsKrux

Krux

Open-source signing firmware for Kendryte K210 devices.

BitcoinHardware walletsNormal
Repository coverage

216 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

58security candidates41second-pass queue15AI analyses
39commits · 30 days
59commits · 60 days
100commits · 180 days
216commits · 365 days
Backfill bands
Aug 5 → Feb 6116 seen6 candidatesComplete
Feb 6 → Jun 639 seen3 candidatesComplete
Jun 6 → Jul 622 seen1 candidatesComplete
Jul 6 → Aug 538 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

65/100 average clarity
59Strong · 80–100
62Adequate · 60–79
79Thin · 40–59
16Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Odudex29145272
odudex89297159
Tads36101063
qlrd1620082
kdmukai422066
tadeubas410038
kkdao1200083
Jean Do600078
Naman015500060
bitcoisas500066
SatsCzar200062
Naman Gupta200079
Analysis record

Published AI watches

Last scanned 2 minutes ago

Moderate 66 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject a PSBT whose outputs exceed its inputs

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but …

Input validation gap in PSBT parsingUI rendering bug masking invalid transaction economicsPotential social-engineering / user-confusion attack
d6813d88by odudex+52−02 files
Vendor flagged security relevance
High 78 AI analysisMessage 95 · Strong
KX KruxKrux BitcoinHardware wallets

fix: verify PSBT input amounts before showing the fee

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify …

Fixes fee-display/sighash amount mismatchAdds prevout txid hash verification for non_witness_utxoMandates non_witness_utxo for legacy inputs
fc808059by odudex+353−122 files
Vendor flagged security relevance
Moderate 62 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

feat: warn when PSBT input amounts cannot be verified

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction co…

New user-facing warning for unverified multi-input SegWit amountsDetection logic tied to BIP143 signature semantics and inp.is_verifiedDoes not enforce previous-transaction inclusion; user can still proceed
518b3314by odudex+159−24 files
Vendor flagged security relevance
Moderate 55 AI analysisMessage 82 · Strong
KX KruxKrux BitcoinHardware wallets

chore: bump MaixPy with Shannon changes and RNG removal

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is …

Commit message explicitly mentions fixing a heap overflowRemoval of an unused cryptographic/randomness binding (os.urandom)Submodule bump only; no source-level patch visible in this commit
5c4ece9aby odudex+1−11 file
Vendor flagged security relevance
Moderate 52 AI analysisMessage 85 · Strong
KX KruxKrux BitcoinHardware wallets

fix: remove Maix Bit and CIF camera support

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVG…

Buffer overflow / scratch buffer overflow claimed in commit message (49,152 bytes)Removal of vulnerable hardware code path rather than hardening the entropy moduleDiscontinuation of affected device reduces real-world exposure
8090ac73by odudex+11−1279 files
Vendor flagged security relevance
Low 37 AI analysisMessage 90 · Strong
KX KruxKrux BitcoinHardware wallets

docs: self-host math, remove MathJax/require.js CDN

This change removes third-party web scripts (MathJax and require.js loaded from a content delivery network) from the project's documentation and replaces them with self-hosted, pre-rendered math images. That eliminates a supply-chain risk …

Removal of cdnjs MathJax and require.js external script loadsSelf-hosting of rendered math assets as static SVGsExplicit commit message reference to supply-chain class (polyfill.io incident)
492820a1by odudex+8779−8928 files
Vendor flagged security relevance
High 74 AI analysisMessage 83 · Strong
KX KruxKrux BitcoinHardware wallets

Security Hardening (#851)

This commit fixes four security weaknesses in Krux, a Bitcoin hardware-wallet project. The changes prevent: (1) encrypted backups from declaring zero or very low password-stretching effort, which would make them easy to brute-force; (2) mu…

Minimum PBKDF2 iteration enforcement against trivial work-factor envelopesRejection of multiple origin-less xpubs in multi-key descriptorsSD file-list filtering of traversal entries ('.', '..', path separators)
8f62c860by Odudex+263−39 files
Vendor flagged security relevance
Moderate 60 AI analysisMessage 93 · Strong
KX KruxKrux BitcoinHardware wallets

fix: warn user before signing raw hashes in message signing (#846)

This commit adds a warning screen to Krux's message-signing feature when the user is about to sign a raw 32-byte hash or a 64-character hex string. Previously, the device would silently treat such inputs as already-hashed values and sign t…

Silent signing of raw 32-byte values allowed transaction sighash spoofingMessage signing path treated raw hashes identically to SHA256(message) digestsFix explicitly references 'C3 of #843' as a security concern
23bc73b3by Odudex+46−726 files
Vendor flagged security relevance
High 78 AI analysisMessage 98 · Strong
KX KruxKrux BitcoinHardware wallets

fix: reject PSBT inputs with non-standard sighash types before signing (#844)

Krux is a small, open-source Bitcoin signing device (hardware wallet). This commit fixes a security flaw where the device would sign transactions even if the sender asked it to use unusual Bitcoin signature modes—specifically SIGHASH_NONE,…

Explicit security fix for externally-reported audit finding (#843 C2)Pre-sign validation added to reject non-standard sighash typesRelevant to transaction-replacement / fund-redirect attacks via SIGHASH_NONE/SINGLE/ANYONECANPAY
e5318112by Odudex+115−03 files
Vendor flagged security relevance
Low 36 AI analysisMessage 98 · Strong
KX KruxKrux BitcoinHardware wallets

chore: require urllib3 >2.6 security fix for CVE-2025-66471 urllib3 is dependency of requests and translate, used in dev tools

This commit updates the project's Python dependency lock file to require urllib3 version 2.6.0 or newer. The commit message says this is a security fix for CVE-2025-66471, a vulnerability in the urllib3 library. urllib3 is used indirectly …

Dependency version bump for a reported CVE (CVE-2025-66471)urllib3 constrained to >=2.6.0Affected packages moved from main to dev dependency group, limiting runtime exposure
268f3f7bby odudex+23−172 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 73 · Adequate
KX KruxKrux BitcoinHardware wallets

Refactor capture entropy test to be less fragile, more DRY (#781)

This commit only refactors a single test file to make the tests less brittle and remove duplicated code. It does not change any production code, cryptographic logic, or user-facing behavior. There is no security issue here.

f091ec71by kdmukai+18−511 file
No security note in commit
Informational 15 AI analysisMessage 63 · Adequate
KX KruxKrux BitcoinHardware wallets

Minor UI change: Add line break for "bits/px" Shannon's entropy text (#780)

This commit is a cosmetic user-interface change. It splits a single line of text showing camera-captured entropy statistics into two lines so it fits better on small screens. No security-sensitive code, calculations, or behavior was altere…

30efd634by kdmukai+52−2725 files
No security note in commit
Low 37 AI analysisMessage 58 · Thin
KX KruxKrux BitcoinHardware wallets

Give warning for non-ASCII BIP39-passphrase (#769)

This change relaxes a safety rule in the Krux hardware wallet firmware. Previously, if a user scanned a BIP39 passphrase QR code containing non-English/non-ASCII characters (for example accented letters or symbols), Krux would block it wit…

Relaxation of input validation for BIP39 passphraseNon-ASCII passphrase now allowed after warning instead of blockedBIP39 NFKD normalization not performed due to firmware size constraints
fad4a0b8by Tads+53−1127 files
Vendor flagged security relevance
Low 44 AI analysisMessage 58 · Thin
KX KruxKrux BitcoinHardware wallets

Embit update: Improved BIP39 mnemonic validation (#759)

This commit tightens how a Bitcoin wallet tool (Krux) checks recovery phrases. Previously, the code accepted phrases with extra spaces, tabs, newlines, or commas between words because it used a loose 'strip and split' approach. Now it requ…

Stricter input validation for BIP39 mnemonic parsingRejection of whitespace-normalized parsing that could mask malformed user inputAlignment with upstream embit validation behavior
6806a792by Odudex+43−33 files
No security note in commit
Moderate 64 AI analysisMessage 74 · Adequate
KX KruxKrux BitcoinHardware wallets

Release 25.10.1 (#757)

This release fixes a bug in Krux, a Bitcoin signing device firmware. When a user scanned an encrypted QR code meant to provide a wallet passphrase, address, or wallet descriptor, the device could silently treat the raw encrypted bytes as t…

Silent derivation of wrong wallet from encrypted passphrase/data due to uncaught decoding exceptionCross-runtime behavior difference: CPython UnicodeDecodeError vs MaixPy TypeErrorMissing input validation for passphrase character set
64212093by Odudex+259−610 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityperf(test): stub gc.collect during testsby odudex · 29e4d43b · Jul 27, 2026 · 2 filesMessage 90 · StrongTriage 0Details
Commit message · odudex

perf(test): stub gc.collect during tests

krux calls gc.collect() to manage the device's small heap. On CPython each
call walks the much bigger test heap of mock objects for no benefit: 151s to
118s for the full suite, same coverage.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidatefix(test): fake the clock in test_fill_flash timeout testby qlrd · 9fecf150 · Jul 27, 2026 · 1 fileMessage 95 · StrongTriage 25Details
Commit message · qlrd

fix(test): fake the clock in test_fill_flash timeout test

test_fill_flash_insufficient_entropy_scenario waited 25 real seconds for
MAX_CAPTURE_PERIOD to elapse, spinning ~500k iterations that piled up mock
call records. Patching time.time in fill_flash fires the timeout after 4
frames: 25.1s to 0.09s, same coverage.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
entropy or randomness
AI review queuedchore(i18n): update generated mnemonic action translationsby Naman015 · 022b70d5 · Jul 27, 2026 · 23 filesMessage 62 · AdequateTriage 0Details
Commit message · Naman015

chore(i18n): update generated mnemonic action translations

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
translation-only discountsecond-pass: unusually broad change
AI review queueddocs: add generated mnemonic flow screenshotsby Naman015 · 61807e7e · Jul 27, 2026 · 8 filesMessage 57 · ThinTriage 12Details
Commit message · Naman015

docs: add generated mnemonic flow screenshots

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
Lower-prioritytest: cover generated mnemonic action flowby Naman015 · 21bd8e4c · Jul 27, 2026 · 1 fileMessage 67 · AdequateTriage 0Details
Commit message · Naman015

test: cover generated mnemonic action flow

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritydocs: document generated mnemonic actionsby Naman015 · c0759d9e · Jul 27, 2026 · 2 filesMessage 57 · ThinTriage 0Details
Commit message · Naman015

docs: document generated mnemonic actions

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityrefactor: extract wallet info menu helperby odudex · 1b068748 · Jul 27, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · odudex

refactor: extract wallet info menu helper

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfeat: simplify generated mnemonic actionsby Naman015 · aed4b007 · Jul 27, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · Naman015

feat: simplify generated mnemonic actions

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritychore(Embit): bump to fff7ffaby odudex · 77fc9698 · Jul 27, 2026 · 1 fileMessage 57 · ThinTriage 0Details
Commit message · odudex

chore(Embit): bump to fff7ffa

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritydocs(parts): mark Maix Amigo as discontinued, drop sale linksby joaozinhom · 1b311fad · Jul 10, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · joaozinhom

docs(parts): mark Maix Amigo as discontinued, drop sale links

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritychore: remove unused color constantsby qlrd · 3c5f395c · Jul 10, 2026 · 1 fileMessage 88 · StrongTriage 0Details
Commit message · qlrd

chore: remove unused color constants

This commit removes two constants on `src/krux/themes.py` once the
`vulture` tool found with a 60% of confidence their possibility to be a
dead code.

Fix #900

Co-authored-by: Naman Gupta <55298452+Naman015@users.noreply.github.com>

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Lower-prioritydocs(parts): mark Maix Amigo as discontinued, drop sale linksby joaozinhom · 7ea3f95e · Jul 10, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · joaozinhom

docs(parts): mark Maix Amigo as discontinued, drop sale links

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Security candidatechore: update cUR and k_quirkby odudex · f4796afe · Jul 8, 2026 · 1 fileMessage 57 · ThinTriage 12Details
Commit message · odudex

chore: update cUR and k_quirk

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update path
Security candidatefix: pin gcc base image by digestby odudex · ceefbb19 · Jul 8, 2026 · 1 fileMessage 57 · ThinTriage 18Details
Commit message · odudex

fix: pin gcc base image by digest

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
access control
Lower-priorityfix: add src to poe task PYTHONPATHby odudex · 566a0b93 · Jul 2, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · odudex

fix: add src to poe task PYTHONPATH

Ensure poe-launched commands can import the local krux package under uv, where the project itself is not installed as a package.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Lower-priorityfix: return None when decrypting an unknown or non-dict mnemonic idby kkdao · a2882082 · Jul 2, 2026 · 2 filesMessage 95 · StrongTriage 0Details
Commit message · kkdao

fix: return None when decrypting an unknown or non-dict mnemonic id

MnemonicStorage.decrypt() resolved the id inside a try/except but then
called stored_value.get("b64_kef") outside it, so an unknown id (where
storage.get returns None) raised AttributeError instead of returning None.
A malformed seeds.json that parses to a non-dict (e.g. a JSON list) hit the
same path. Resolve the source dict and return None when the id is missing
or the stored entry isn't a dict -- no bare except, behaviour now tested.

The sole caller wraps the call in try/except, so this changes no on-device
behaviour; it gives decrypt() a clean return contract.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
AI review queuedrefactor: drop non-dict JSON coercion in encryption storageby kkdao · 2d195ad3 · Jul 2, 2026 · 2 filesMessage 85 · StrongTriage 0Details
Commit message · kkdao

refactor: drop non-dict JSON coercion in encryption storage

Loading seeds.json no longer coerces valid-but-non-dict JSON to an
empty dict, so a wrong-shape file is preserved instead of being
silently overwritten on the next store. decrypt() keeps the
isinstance(source, dict) guard that prevents a crash on such files.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
Lower-priorityrefactor: narrow mnemonic storage file-load errorsby kkdao · aebbfc92 · Jul 2, 2026 · 2 filesMessage 85 · StrongTriage 0Details
Commit message · kkdao

refactor: narrow mnemonic storage file-load errors

The four read/load fallbacks in MnemonicStorage caught everything with a
bare `except:`, hiding unexpected errors (and on the K210 even
KeyboardInterrupt/MemoryError). Narrow them to the file/JSON errors they
actually expect -- (OSError, ValueError) -- matching the OSError
convention already used in sd_card.py. Behaviour for a missing/unreadable
file or malformed JSON is unchanged (storage starts empty / first store
still writes); a genuinely unexpected error now propagates instead of
hiding.

The decrypt and write catches stay broad on purpose (wrong-key /
failed-save contracts) and are now commented as such.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
AI review queuedfix: preserve corrupt seeds.json instead of overwriting on storeby odudex · e44d4324 · Jul 2, 2026 · 4 filesMessage 85 · StrongTriage 0Details
Commit message · odudex

fix: preserve corrupt seeds.json instead of overwriting on store

store_encrypted_kef raises StorageCorruptedError and leaves the file
untouched when an existing seeds.json is malformed or a non-dict, rather
than silently overwriting recoverable data. list_mnemonics returns [] for
non-dict storage so corrupt files no longer crash the menu; the UI reports
the corruption (English-only) and skips the store.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
Lower-priorityfix: improve default theme contrast (#879)by Naman Gupta · 782735a6 · Jun 23, 2026 · 5 filesMessage 65 · AdequateTriage 0Details
Commit message · Naman Gupta

fix: improve default theme contrast (#879)

65/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-priorityrefactor: cache Settings() namespace tree as a singletonby odudex · 0f28c9a7 · Jun 23, 2026 · 2 filesMessage 85 · StrongTriage 0Details
Commit message · odudex

refactor: cache Settings() namespace tree as a singleton

Avoids rebuilding ~16 namespace objects on every Settings() call;
values are still read live from the store singleton.

Reset the cache in mock_retro_compatibility so the patched
DefaultWallet is picked up.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Lower-priorityrefactor: dedupe flipped-orientation check in touch.py via is_flipped_orientationby kkdao · a0924c7c · Jun 17, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · kkdao

refactor: dedupe flipped-orientation check in touch.py via is_flipped_orientation

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatedocs: update `poetry` to `uv commandsby qlrd · 55c72c34 · Jun 17, 2026 · 4 filesMessage 57 · ThinTriage 0Details
Commit message · qlrd

docs: update `poetry` to `uv commands

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
Lower-priorityfeat: replace `poetry` to `uv` as venv managerby qlrd · a8eca7c8 · Jun 17, 2026 · 3 filesMessage 90 · StrongTriage 0Details
Commit message · qlrd

feat: replace `poetry` to `uv` as venv manager

This commit replaces the current virtualenv manager to `uv`. It's a
battle tested one and well accepted by community. It do not changes the
current behaviour of `poe` tasks, instead, we noted a faster run with
this manager.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-prioritychore: update `poetry` to `uv` commands.by qlrd · 5752a688 · Jun 17, 2026 · 3 filesMessage 57 · ThinTriage 0Details
Commit message · qlrd

chore: update `poetry` to `uv` commands.

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body