AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 33 Bitcoin

support passphrase after setup

Public commit record

What the developer wrote

Authored by ww3512687

35/100 · Opaque
support passphrase after setup
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
The short version

What changed, and why it matters

This commit adds the ability to set a BIP-39 passphrase during wallet creation and import, not just afterward in settings. Most of the change is UI flow wiring, but it also fixes a small bug in the SLIP-39 salt construction and adds a length check for passphrases. There is no clear security vulnerability introduced by the patch itself; the main risk is that passphrase handling is complex and any mistake could lock users out of funds or, in edge cases, weaken key derivation.

Recommended action

Treat as a normal feature commit. Review the SLIP-39 salt change for standards compliance (SLIP-39 extendable backups use a specific salt prefix), verify the 255-byte passphrase limit is consistent with BIP-39/SLIP-39 expectations, and ensure the passphrase is cleared from SRAM after use. No immediate security patch is indicated.

Security signals we found

01

Passphrase now participates in initial wallet creation/import key derivation

02

SLIP-39 salt construction changed from fixed 6-byte copy to zero-init + strlen-based copy

03

Passphrase length capped at 255 bytes in MasterSecretEncrypt

04

New random_buffer combines three RNG sources for entropy generation

05

Passphrase cached in SRAM and passed via UI signal pointers

Risk score

Why this scored 33/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.