What the developer wrote
Authored by kdmukai
Minor bugfix to correct if/else path
What changed, and why it matters
This commit fixes a small logic bug in SeedSigner, a hardware-wallet-like signing device. The code was checking whether a seed's fingerprint string was empty, but it should have been checking whether the seed has a passphrase. The bug could cause the app to skip computing or displaying the seed fingerprint at the wrong time, potentially confusing the user about which seed they are finalizing. There is no direct evidence in the commit that this is a security vulnerability, and no exploit path is described.
Review the SeedFinalizeView flow to confirm the fingerprint is now computed and displayed correctly for both passphrase and non-passphrase seeds. Consider adding a regression test for this branch.
Security signals we found
Logic bug in seed finalization flow
Incorrect fingerprint display condition
Potential user confusion during seed setup
Evidence from the diff
In SeedFinalizeView.init, the condition if self.seed.get_fingerprint == "" was replaced with if not self.seed.has_passphrase. The original check compared the method object itself to an empty string, which is always False, so the else branch was always taken. The corrected check uses the seed’s passphrase flag to decide whether to compute the fingerprint directly. This aligns the control flow with the intended user flow for seeds without a passphrase.
Changed components
src/seedsigner/views/seed_views.pySeedFinalizeViewInspect captured patch +3 / −2
diff --git a/src/seedsigner/views/seed_views.py b/src/seedsigner/views/seed_views.py
index 65830d3..45881fb 100644
--- a/src/seedsigner/views/seed_views.py
+++ b/src/seedsigner/views/seed_views.py
@@ -307,8 +307,9 @@ class SeedFinalizeView(View):
super().__init__()
self.seed = self.controller.storage.get_pending_seed()
- if self.seed.get_fingerprint == "":
- # Expected normal user flow
+ if not self.seed.has_passphrase:
+ # Expected normal user flow. A freshly-loaded seed has no passphrase yet, so
+ # we can just get the fingerprint directly.
self.fingerprint = self.seed.get_fingerprint(network=self.settings.get_value(SettingsConstants.SETTING__NETWORK))
else:
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.