Skip to content

KeepKey Vault v1.4.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jun 01:17
v1.4.6
e4ca88c
This commit was signed with the committer’s verified signature.
BitHighlander Highlander
GPG key ID: 9E2FF33FBC59937A
Verified
Learn about vigilant mode.

KeepKey Vault v1.4.6

A hardening + fixes release focused on Zcash shielded (Orchard) sends, the Windows installer, and watch-only mode.

Highlights

  • Zcash shielded (private) sends — NU6.2 compatible + hardened. Upgraded to the post-NU6.2 Orchard circuit (fixes "could not validate orchard proof" on mainnet), with correct Merkle-root/anchor construction for shield, deshield, and z→z PCZTs. Every shielded transaction is now locally validated — Orchard proof verification, full BatchValidator, and a device-signed-vs-consensus sighash check — before it is broadcast, and is broadcast to multiple lightwalletd nodes with per-node verdicts.
  • Anti-bleed device binding. The cached Orchard viewing key is proven to belong to the connected device before any shielded balance is shown or any spend is built, so a previous device/seed (including a same-handle passphrase / hidden-wallet toggle) can never surface a phantom balance or build against the wrong wallet. A new verify-device diagnostic confirms a balance belongs to the connected KeepKey.
  • Address book in private send. Save and reuse shielded recipient addresses.

Bug fixes & hardening

  • Windows installer fixed. Deep nested dependency trees (newly bundled Pioneer discovery) pushed staged paths past Windows MAX_PATH and broke the 1.4.5 Windows installer build. Nested duplicates are now collapsed so the installer packages correctly, with a loud failure if any path still exceeds the limit. macOS/Linux are unaffected.
  • Watch-only mode keeps the balance-refresh button available (#279).
  • Emulator shows the confirm button for Zcash address display and ETH verify-message.

Security

  • Shielded send paths are fully fail-closed: the device + UI gate every send (emulator included), non-zero accounts are rejected, amounts are bounds-checked, and transactions that would be rejected on-chain are aborted locally first.
  • Raw-transaction parsing is hardened against a malicious lightwalletd (no unbounded allocation), and over-length memos are rejected rather than silently truncated.
  • Bumped rustls-webpki 0.103.9 → 0.103.13 (RUSTSEC-2026-0049 / 0098 / 0099 / 0104) in the Zcash sidecar's TLS stack.

Included PRs

#271 emulator display confirm button · #272 PCZT frontier anchor · #273 PCZT ordered tree build · #274 FVK device-verify (anti-bleed) · #277 verify-device diagnostic · #278 shielded send/scan security hardening · #279 watch-only refresh · #280 Windows MAX_PATH installer fix

Downloads

File Platform SHA-256
KeepKey-Vault-1.4.6-arm64.dmg macOS (Apple Silicon) d0f1d4cad33fc1454fc530652d0b96bbb4ed4d35f7b4d2959e030087cdf678f2
KeepKey-Vault-1.4.6-x86_64.dmg macOS (Intel) 7f46dfcfbe70ca866e0c7528e0e464f5137569cf09e9581a9d802066394ba5ce
KeepKey-Vault-x86_64.AppImage Linux 3530a90b6828fe5cd2c7c7154ff6598621fea82ba2f4a71ae667321d1a6bc317
KeepKey-Vault-1.4.6-win-x64-setup.exe Windows added separately by the Windows build

Full checksums for every artifact are in SHA256SUMS.txt.

Verify (macOS)

xcrun stapler validate KeepKey-Vault-1.4.6-arm64.dmg
spctl -a -vvv -t install KeepKey-Vault-1.4.6-arm64.dmg
Assets 16
Loading