sign_psbt: add early reject on wrong genesis blockhash
What the developer wrote
Authored by Mike Tolkachev
sign_psbt: add early reject on wrong genesis blockhash
What changed, and why it matters
This commit fixes a bug in the Blockstream Jade hardware wallet's PSBT (Partially Signed Bitcoin Transaction) signing code. Previously, when the transaction's genesis block hash did not match the expected network, the code set an error message but accidentally continued processing instead of stopping. This one-line fix adds the missing 'return' so the device rejects mismatched transactions immediately. Without the fix, a user could potentially be tricked into signing a transaction on the wrong network, which might lead to loss of funds or confusion between mainnet and testnet/signet assets.
Apply the patch. After applying, verify that all validation failures in the signing path terminate the request with an appropriate error code, and add regression tests for genesis hash mismatches on each supported network.
Security signals we found
Missing return in error path allows execution to continue after validation failure
Cross-network genesis hash mismatch not enforced as a hard failure
PSBT signing logic accepts mismatched network parameters
Potential wrong-network transaction signing
Evidence from the diff
In main/process/sign_psbt.c, the function sign_psbt() checks whether the PSBT’s genesis_blockhash matches the genesis hash for the selected network. Before this patch, on mismatch it assigned *errmsg = “Network/pset genesis mismatch” but fell through and continued signing. The patch adds ‘return CBOR_RPC_BAD_PARAMETERS;’ so the function exits with an RPC error. This is a control-flow integrity fix: the error path was non-terminating, allowing a malformed or cross-network PSBT to proceed past the validation check.
Changed components
main/process/sign_psbt.csign_psbt() functionPSBT/PSET signing flowNetwork/genesis validationInspect captured patch +1 / −0
diff --git a/main/process/sign_psbt.c b/main/process/sign_psbt.c
index 69a8dc3..f475f32 100644
--- a/main/process/sign_psbt.c
+++ b/main/process/sign_psbt.c
@@ -742,6 +742,7 @@ int sign_psbt(jade_process_t* process, CborValue* params, const network_t networ
network_to_genesis_hash(network_id, genesis, sizeof(genesis));
if (memcmp(psbt->genesis_blockhash, genesis, sizeof(genesis))) {
*errmsg = "Network/pset genesis mismatch";
+ return CBOR_RPC_BAD_PARAMETERS;
}
}
}
Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.