sign_psbt: use the signature type of inputs we are signing instead of a bool
What the developer wrote
Authored by Jon Griffiths
sign_psbt: use the signature type of inputs we are signing instead of a bool
Also drive-by fix a log line.
What changed, and why it matters
This commit changes how a Bitcoin hardware wallet (Blockstream Jade) tracks which transaction inputs it needs to sign. Previously it stored a simple yes/no flag; now it stores the actual signature type requested by the PSBT (Partially Signed Bitcoin Transaction). The change is mostly a code-quality improvement, but it removes a place where the wrong signature type could silently be assumed. There is no direct evidence in the commit that an actual vulnerability was fixed, and no vendor security disclosure is present.
Treat as a hardening/correctness patch rather than an urgent security fix. Reviewers should verify that sig_type values returned by wally_psbt_get_input_signature_type are validated against supported signature types before use, and that downstream signing logic now consumes the explicit type where needed. No immediate user action is required unless the vendor later discloses this as a security fix.
Security signals we found
Change from boolean flag to explicit signature-type value reduces risk of defaulting to an incorrect signature type
No bounds check shown for the uint8_t cast from uint32_t sig_type, though values are expected to be small enum-like constants
No explicit validation that the returned signature type is one the firmware supports before storing it
Log-line correction is unrelated to security
Evidence from the diff
In main/process/sign_psbt.c, the local array tracking which PSBT inputs the Jade will sign is changed from bool signing_inputs to uint8_t sig_types. The new array is populated by calling wally_psbt_get_input_signature_type() for each input the wallet controls, and the value is later used only as a truthiness check to decide whether to sign. The signature type itself is not consumed in the shown diff. A log message is also corrected from ‘output’ to ‘input’. The commit does not show any behavioral change in signature production, only that the type is now available rather than inferred or ignored.
Changed components
main/process/sign_psbt.cPSBT signing flowInspect captured patch +9 / −6
diff --git a/main/process/sign_psbt.c b/main/process/sign_psbt.c
index 00acf69..56b201c 100644
--- a/main/process/sign_psbt.c
+++ b/main/process/sign_psbt.c
@@ -696,8 +696,8 @@ int sign_psbt(const network_t network_id, struct wally_psbt* psbt, const char**
// Go through each of the inputs summing amounts
// Also, if we are signing this input, inspect the script type and any multisig info
- // Record which inputs we are interested in signing
- bool* const signing_inputs = JADE_CALLOC(psbt->num_inputs, sizeof(bool));
+ // For inputs we are signing, record the signature type
+ uint8_t* const sig_types = JADE_CALLOC(psbt->num_inputs, sizeof(uint8_t));
uint64_t input_amount = 0;
uint8_t signing_flags = 0;
char wallet_name[NVS_KEY_NAME_MAX_SIZE] = { '\0' };
@@ -726,7 +726,10 @@ int sign_psbt(const network_t network_id, struct wally_psbt* psbt, const char**
// Found our key - we are signing this input
JADE_LOGD("Key %u belongs to this signer, so we will need to sign input %u", iter.key_index, index);
- signing_inputs[index] = true;
+ uint32_t sig_type;
+ JADE_WALLY_VERIFY(wally_psbt_get_input_signature_type(psbt, index, &sig_type));
+ JADE_ASSERT(sig_type);
+ sig_types[index] = (uint8_t)sig_type; // Sufficient
const size_t num_keys = key_iter_get_num_keys(&iter);
if (num_keys > 1) {
@@ -765,7 +768,7 @@ int sign_psbt(const network_t network_id, struct wally_psbt* psbt, const char**
size_t path_len = 0;
uint32_t path[MAX_PATH_LEN];
if (!key_iter_get_path(&iter, path, MAX_PATH_LEN, &path_len)) {
- JADE_LOGE("No valid path in output %u, ignoring", index);
+ JADE_LOGE("No valid path in input %u, ignoring", index);
continue;
}
@@ -927,7 +930,7 @@ int sign_psbt(const network_t network_id, struct wally_psbt* psbt, const char**
for (size_t index = 0; index < psbt->num_inputs; ++index) {
// See if we flagged this input for signing
- if (!signing_inputs[index]) {
+ if (!sig_types[index]) {
JADE_LOGD("Not required to sign input %u", index);
continue;
}
@@ -981,7 +984,7 @@ cleanup:
}
free(descriptor);
free(multisig_data);
- free(signing_inputs);
+ free(sig_types);
free(output_info);
return retval;
}
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.