Independent alpha audit remediation: signing, storage, entropy, and CI evidence

[BitHighlander]

Outcome

Independent alpha remediation produced while observing and checking the looping auditor. The review reproduced its findings in pinned Docker, found additional signing/report defects, filed them on the fork tracker, and repaired both firmware and the companion Python harness.

Security fixes

• make V20 storage commits crash-recoverable and old-bootloader compatible; keep setup state atomic and mint checked per-record PIN salt (ResetDevice(no_backup=true) silently drops the no_backup flag: storage_setU2FCounter() commits mid-ceremony and the commit's own backstop memzeroes setup before line 179 reads it #523-PIN-KDF per-device salt is never drawn: it is 32 zero bytes on every device initialized after storage V2 and after every WipeDevice #525)
• fail closed on RNG health failure for PIN/recovery permutations and scrub recovery state on early exits (PIN scramble matrix and recovery substitution cipher draw unchecked randomness and are on neither the covered list nor the accepted-raw list #526, New recovery-cipher rejection path returns without wiping new_mnemonic, leaving the user's typed seed phrase in the confidential section #532)
• clear plaintext TOTP, derived-node, transaction-node, and decrypted storage caches when authorization is lost (authenticator: TOTP secrets survive device lock #398, Wipe code leaves the plaintext seed in RAM #457; also reinforces closed CRITICAL: SignTx's master root private key is never scrubbed from RAM -- survives session teardown, Cancel, and even WipeDevice #561)
• reject invalid multisig quorum before fee/weight accounting (BTC: unbounded multisig m inflates tx_weight and suppresses the fee warning #449)
• enforce exact nanopb bytes capacity without corrupting oneof/fixed-count descriptor traversal (nanopb's ALLOCSIZE check lets every odd-sized bytes field decode one byte longer than its .options max_size #530, Nanopb bytes-capacity fix leaves oneof and fixed-count descriptor initializers misaligned #596)
• display exact binary confirmation payloads, including unsupported Omni OP_RETURN bytes and nonzero native value on transformed ERC20 routes (confirm_data truncates OP_RETURN to 50 bytes and its ".." marker is dead code #531, firmware: unsupported Omni OP_RETURN signs without disclosing payload bytes #597, transformERC20 clear-signing hides nonzero native transaction value #598)
• bind complete streamed EVM calldata, including the final Ack tail, into the signed digest and user-visible evidence (EVM: contract-call data display shows only the first chunk of what is signed #400)
• fail closed if the vetted token-definition source is missing or empty (Token definition generator silently emits an empty table #446)
• bind Solana SPL, stake, System, nonce, vote, and ATA prompts to signed identities and signed decimals (Solana SPL clear-sign screens omit affected account, mint, and refund destination #558-Solana MintToChecked and BurnChecked prompts ignore signed decimals #560, Solana verified prompts still omit source/target identities across System, nonce, vote, and ATA instructions #588, PR #591 ATA Create remains verified with a missing fourth mint account #595)

Evidence and CI fixes

• add successful Uniswap add/remove native coverage and restore all three mandatory Python liquidity vectors (Uniswap liquidity approval path has no automated coverage anywhere: the only integration tests skip unconditionally on the emulator and the native tests only ever assert refusal #516, consolidated Python harness reintroduces mandatory Uniswap skips #606)
• require declared OLED frame counts; capture manual reset/recovery/dice/EIP-712/storage protocol flows; model valid CRC-framed storage journals (Screenshot audit is presence-only and is satisfied by setUp's wipe-confirmation frames, so a test that draws none of its declared screens still passes #529, manual Python protocol flows bypass declared OLED screenshot evidence #600-storage version gate corrupts framed journal fixtures and masks failures #602)
• retain retired Binance and multisig negative regressions (Retired Binance signing surface lost its full-feature negative regression when PR #57 deleted the entire suite #594, BTC: unbounded multisig m inflates tx_weight and suppresses the fee warning #449)
• make bitcoin-only confirmation regressions link against the shared driver (bitcoin-only emulator cannot link shared confirmation regressions #599)
• repair fork CircleCI checkout and exact companion-revision pinning (fork companion CircleCI clones upstream and never tests security branches #603)
• require the native firmware suite to finish successfully before the Compose report target can generate a Python report (Compose report target omits required native test evidence #605)
• scope secret scanning to the triggering revision and keep the checksum-verified scanner binary (Alpha accepted PR #557 with red CI and every firmware build/unit/integration job skipped #583, CI secret scanner overwrites checksum-verified gitleaks with an unverified binary #586)

Verification

• clean pinned Docker gate at firmware 7d3cf278e61a8fc7497721216a072eaf302b486b / python-keepkey b9ab241cdf9f3c7fb8c097dcacaba4cb5620299f: exit 0
• the only subsequent Python code change narrows the RC18 version boundary; both 7.16 execution paths are identical, and current/bitcoin-only/RC18 GitHub integrations pass at 4641244f57af0967e7b97ca1aeb149b20aba54d3
• CircleCI build 361 passes the exact Python head with fork checkout, native dependency, screenshots, full suite, catalog, and PDF generation
• merged companion pin 8e59e4c58c8e59150426bdcfdd27eac9b6bb65a9 is tree-identical to the green Python head; final firmware head is e4ec5317d
• native: 579/579 passed across firmware, board, Pallas constant-time, and crypto suites
• Python full suite: 678 passed, 26 intentional skips, 0 failures
• screenshot suite: 222 tests, 0 failures; 1,261 retained PNGs; every declared screen captured
• merged evidence: 2 Python + 4 native JUnit files
• report catalog: firmware 7.16.0, 27 sections, 383 tests; 370 passed, 13 documented skips, 0 failed, 0 pending
• generated artifact: 125-page PDF
• Uniswap evidence: 3/3 signatures and 16 reviewed OLED frames (approval 3, add 7, remove 6)
• final-head GitHub checks are required green before merge

Companion PR: BitHighlander/python-keepkey#59

Closes #398
Closes #400
Closes #446
Closes #449
Closes #457
Closes #516
Closes #523
Closes #524
Closes #525
Closes #526
Closes #529
Closes #530
Closes #531
Closes #532
Closes #558
Closes #559
Closes #560
Closes #588
Closes #594
Closes #595
Closes #596
Closes #597
Closes #598
Closes #599
Closes #600
Closes #601
Closes #602
Closes #603
Closes #605
Closes #606

[BitHighlander]

Follow-up audit remediation added after opening this PR:

• Closes Solana verified prompts still omit source/target identities across System, nonce, vote, and ATA instructions #588: remaining verified Solana System/nonce/stake/vote/ATA paths now display affected signed identities, require canonical account layouts, and correct Stake/Vote Authorize current-authority extraction from clock-sysvar index 1 to signer index 2. All 49 Solana native tests pass.
• The pinned python-keepkey PR now skips retired native Binance signing only when the handler is absent, removes its stale report certification, and version-gates the EOS UpdateAuth golden hash: 7.16 correctly omits the phantom wait fixed by EOS eos_hashAuthorization(): waits[] serialization loop is bounded by accounts_count instead of waits_count -- hashes stale/uninitialized entries not shown on screen #568 while RC18 retains its historical vector.
• The CI scanner install now asserts that the executed version is exactly the checksum-verified pin.

[BitHighlander]

Independent follow-up completed:\n\n- #448 and duplicate #461 are now closed with a cryptographic regression at 616b8d3 proving the reviewed Solana message slice is exactly the signed slice for the optional zero-prefixed wire form.\n- #462 is closed: alpha commit da73417 fails both legacy and versioned oversized-account layouts as malformed; the boundary suite covers 33 and 256 accounts.\n- Python base CI was already red in run 32677388920 on three post-RC18 tests. a388ddef adds precise 7.16 firmware gates to the MAYA exactly-one-message, Ironwood empty-Orchard, and 72-byte multisig hardening tests. These checks were implemented by alpha commits 71e6c1d and 40da090 after RC18, so skipping only those cases on RC18 restores an honest compatibility lane without weakening current-alpha coverage.

[BitHighlander]

Audit update at c6fe3a0: the firmware-dependent Python multisig regression was removed from standalone python-keepkey CI and replaced with a native pure-predicate regression at the exact fee-accounting boundary. Pinned Docker compilation passed. Targeted Signing.MultisigQuorumMustBeBoundedBeforeFeeAccounting passed; full native suite ran 520 tests with 517 passing and only the three known local token-table/transform baseline failures. LLVM 20 formatting and git diff checks pass. Python PR #56 is restored to a tree-equivalent state to its previously passing a388ddef head and has fresh CI running.

[BitHighlander]

CI is red at head 78731bc: python-integration-tests (full variant, NOT bitcoin-only) fails on both runs — deterministic, same failure both times:

SECTIONS validation FAILED: 3 test(s) not green for fw 7.16.0:
  E17 test_msg_ethereum_erc20_uniswap_liquidity::test_sign_uni_approve_liquidity_ETH -> skipped-but-required
  E18 test_msg_ethereum_erc20_uniswap_liquidity::test_sign_uni_add_liquidity_ETH -> skipped-but-required
  E19 test_msg_ethereum_erc20_uniswap_liquidity::test_sign_uni_remove_liquidity_ETH -> skipped-but-required

Root cause: test_msg_ethereum_erc20_uniswap_liquidity.py's setUp() unconditionally skips every test in the file whenever self.client.features.firmware_variant[0:8] == "Emulator" (documented, pre-existing: the ETH/FOX pool contract isn't in the token table, and approving an unknown contract HANGS the emulator rather than failing, so it's gated rather than deleted). This skip fires on every emulator build, full or bitcoin-only — there's no CI path where it doesn't fire.

MUST_RUN_MODULES['test_msg_ethereum_erc20_uniswap_liquidity'] = '7.16.0' (added for #516, per the comment above it) demands this module run non-skipped on build_variant == 'full' for fw≥7.16.0. FULL_FEATURE_ONLY_MUST_RUN_MODULES only exempts bitcoin-only builds — it does not exempt the structural emulator-hang case that applies to full builds too. The result: this gate can never be satisfied by any CI run, on any variant, until the underlying firmware token-approval hang is actually fixed (out of scope here) — real hardware isn't available to this pipeline either.

This isn't a regression from anything else in this PR — MUST_RUN_MODULES's addition for #516 is what has the bug, and it's present in the currently-pinned commit d3660b12. Both PR #587 CI runs (32930315939, 32930311879) reproduce it identically at Phase 2 (~19-20min in, after the screenshot-driven Phase 1 completes cleanly).

Required remediation (matches the existing bitcoin-only exemption pattern, doesn't touch firmware): exempt test_msg_ethereum_erc20_uniswap_liquidity from MUST_RUN_MODULES enforcement on every CI-emulator variant, not just bitcoin-only — e.g. drop the '7.16.0' entry back out of MUST_RUN_MODULES (reverting to pre-#516-enforcement state) while keeping the SECTIONS catalog entries and their existing "PENDING, disclosed" language, so the PDF still documents the gap honestly instead of silently claiming coverage. #516 stays open until the firmware side is fixed for real.

Do not merge #587 at the current head until this resolves.

[BitHighlander]

Final independent audit reconciliation:\n\n- Merged head: e4ec5317d23218aabe7553be1d64b8dd66173e07\n- Alpha merge/tip: 893c93d1072cf52faae601485e7a21b4ff6d3059\n- Both complete final-head CI workflow runs passed, including static analysis, ARM/emulator builds, native/unit/crypto tests, full and Bitcoin-only Python integrations, screenshot report generation, and both aggregate CI gates.\n- Clean Docker evidence: 704 Python tests (678 passed, 26 skipped), 222 screenshot tests (214 passed, 8 skipped), 579 native tests passed, 383 catalog entries (370 passed, 13 skipped), zero failures/errors/pending; 1,261 screenshots and a 125-page report.\n- All 30 issues explicitly covered by this firmware/companion fix set are closed as completed. Unrelated #604 remains open and untouched.\n\nThe companion harness was merged in BitHighlander/python-keepkey#59 and pinned by the firmware merge.