-
Notifications
You must be signed in to change notification settings - Fork 4
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Two production ship-fence tests fail on the ui-px merge tree: rng-consumer-audit sees a dev-only rng::fill
bugSomething isn't workingSomething isn't workingpriority:mediumDefense-in-depthDefense-in-depthsurface:prodtestAttack surface / subsystem: prodtestAttack surface / subsystem: prodtestStatus: Open.#754 In EthereumPhone/PQ1;Factory lockdown sequencing: SECBOOTADD0/SWAP_BANK before BOOT_LOCK, and a BOOT_LOCK=0 bench profile before DFU dies
priority:highSecurity-criticalSecurity-criticalsurface:lockdownAttack surface / subsystem: lockdownAttack surface / subsystem: lockdownsurface:prodtestAttack surface / subsystem: prodtestAttack surface / subsystem: prodtestStatus: Open.#753 In EthereumPhone/PQ1;Flash geometry v7: seven open items before any v7 code can run
enhancementNew feature or requestNew feature or requestpriority:highSecurity-criticalSecurity-criticalsurface:fw-updateAttack surface / subsystem: fw-updateAttack surface / subsystem: fw-updatesurface:lockdownAttack surface / subsystem: lockdownAttack surface / subsystem: lockdownStatus: Open.#752 In EthereumPhone/PQ1;WYSIWYS break on the pixel route: the ERC-7730 adapter drops field values that collide with the navigation vocabulary
bugSomething isn't workingSomething isn't workingfindingAdversarial-review finding; evidence in docs/security/adversarial-review/findings/Adversarial-review finding; evidence in docs/security/adversarial-review/findings/priority:criticalBlocks E2E or critical securityBlocks E2E or critical securitysurface:clear-signingAttack surface / subsystem: clear-signingAttack surface / subsystem: clear-signingsurface:trusted-uiAttack surface / subsystem: trusted-uiAttack surface / subsystem: trusted-uiStatus: Open.#751 In EthereumPhone/PQ1;Pre-flight: read page 126 (BHK) before any mass erase on a unit with unknown provisioning history
source:work-todoMigrated from docs/work-todo.mdMigrated from docs/work-todo.mdStatus: Open.#743 In EthereumPhone/PQ1;The signed bundle does not bind the FSBL — 'the bundle verified' says nothing about the trust root
source:work-todoMigrated from docs/work-todo.mdMigrated from docs/work-todo.mdStatus: Open.#742 In EthereumPhone/PQ1;Doc drift: Makefile:1159 still calls page 125 the 'SE050 admin PIN' page
source:work-todoMigrated from docs/work-todo.mdMigrated from docs/work-todo.mdStatus: Open.#741 In EthereumPhone/PQ1;Makefile:2296 — raw backticks in the bootproof-hw guard execute 'make bootproof-sign'
source:work-todoMigrated from docs/work-todo.mdMigrated from docs/work-todo.mdStatus: Open.#740 In EthereumPhone/PQ1;make bootproof-hw: 'probe-rs erase' is a silent no-op, and a stale marker page then reads as this run's evidence
source:work-todoMigrated from docs/work-todo.mdMigrated from docs/work-todo.mdStatus: Open.#739 In EthereumPhone/PQ1;AW99703 INDSEL: the 2026-08-26 schematic doubles boost inductor L102 to 10 uH, and the driver never writes register 0x05
priority:mediumDefense-in-depthDefense-in-depthsurface:trusted-uiAttack surface / subsystem: trusted-uiAttack surface / subsystem: trusted-uiStatus: Open.#737 In EthereumPhone/PQ1;prod-feature-check: the #705 OVP experiment features are not in PROD_FORBIDDEN, and the denylist covers only 1 of 3 firmware crates
priority:mediumDefense-in-depthDefense-in-depthsurface:releaseAttack surface / subsystem: releaseAttack surface / subsystem: releaseStatus: Open.#735 In EthereumPhone/PQ1;Boot-time unlock loop never calls reset_activity — device flickers Enter-PIN/Locked forever and needs two unlocks (#713 fixed in only one of two paths)
findingAdversarial-review finding; evidence in docs/security/adversarial-review/findings/Adversarial-review finding; evidence in docs/security/adversarial-review/findings/priority:highSecurity-criticalSecurity-criticalsurface:trusted-uiAttack surface / subsystem: trusted-uiAttack surface / subsystem: trusted-uiStatus: Open.#728 In EthereumPhone/PQ1;