Security- and correctness-hardening release. A fresh, whole-app cold security audit held the entire
signing / derivation / parsing / display surface to submission standard and drove every finding to
zero.
Security fixes (HIGH)
- Legacy HD-path length overflow — a host-controlled path-component count drove a memory copy into
the fixed derivation-path global; the count is now bounded (2–5 components) before the copy and the
received length must cover the path bytes. A short-path copy zeroes the tail for deterministic
derivation. - Transfer-template buffer capacity — the structured-transfer template buffer was registered with
the wrong (much larger) capacity; it is now registered with its real size, sized to hold the largest
valid template, and every append is checked so an over-cap input fails closed. - Parser item-array out-of-bounds — three wrong-argument-count branches ignored a "too many items"
signal and could write one past the display function-pointer array; all three now propagate the
error and the loop guards the index.
Display-integrity / robustness (MED/LOW)
Unknown-capability arguments render length-bounded; oversized gas values reject instead of
mis-displaying; legacy reads are bounded by the received length; transfer type is validated; several
accessor returns checked. The transaction hash is shown as the unpadded base64url request key.
Verification
- Four cold re-audit passes, 0 open CRIT/HIGH.
- Full Zemu matrix green (240 tests, all five models, 0 crashes), including new regression cases
for each fix and a full principal-namespace maximum-size cross-chain transfer. - Deterministic builds on all five targets; proven end-to-end on Nano S+ hardware.
- No APDU / wire-protocol change.
Device hashes (deterministic)
| Target | Application hash |
|---|---|
| nanos2 (Nano S+) | 068f376be6115e1769952fabb61020ae5070867c9b2299c259f6947c5b5ce1db |
| nanox | dc28a5786a81c2162725eb89dac3433066c37af3b4c7621177c66c4bad32127c |
| stax | 592296023a6098959ff4f3e00889a6fb64c7dcc4a8fab44f367e89a77c9302e0 |
| flex | d03d46f36b11d267de05b6f2aba60f6d798faabc1d0970afbe13dec138b1fca3 |
| apex_p | 4484159eabe9f65ffa83aaedd7eeb1a3aab3decbaa7cc34988a4bbde5fd535e5 |