Add coin purchase memo support by cedwies · Pull Request #1785 · BitBoxSwiss/bitbox02-firmware

cedwies · 2026-02-11T10:30:03Z

Gate CoinPurchase handling behind a new app-swap feature to limit to BitBox Multi.

One could decide to not gate behind a feature (also including it in BTC only version) since this adds negligible binary size, introduces no new attack surface (receiving aCoinPurchaseMemo requires a valid signature from a known identity), and the protobuf type cannot be cfg-gated anyway since it is generated code.

I chose the strict way and gated behind a new feature, but it may be discussed.

benma · 2026-02-11T14:05:46Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 514a062418

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

messages/btc.proto

cedwies · 2026-02-13T17:14:34Z

Added address derivation field (only eth for now).
I used a dummy derivation path in the tests, so they verify that the field is excluded for the sighash

benma · 2026-02-15T19:37:35Z

Added address derivation field (only eth for now). I used a dummy derivation path in the tests, so they verify that the field is excluded for the sighash

Nice! How about adding validation of it to fn validate in payment_request.rs?

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

cedwies · 2026-02-16T20:09:43Z

To validate the eth keypath I made is_valid_keypath_address(keypath: &[u32]) available. Modified Cargo.toml because app-swap should only be available with app-ethereum. Otherwise, if only app-swap is enabled and not app-ethereum, the code will not compile.

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

src/rust/bitbox02-rust/Cargo.toml

cedwies · 2026-02-19T16:23:23Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d9dd9e9e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-02-19T16:30:30Z

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

+            // TODO: add CoinPurchaseMemo arm when SwapKit UI is finalized
            _ => return Err(Error::InvalidInput),


Accept CoinPurchaseMemo in payment request UI

The new memo type is still funneled into the default rejection path, so any payment request containing coin_purchase_memo is rejected during user_verify() before validate() runs in the BTC signing flow. This makes the added coin-purchase path unusable in practice (including builds with app-ethereum), because the transaction is aborted as invalid input instead of proceeding with the new verification logic.

Useful? React with 👍 / 👎.

benma · 2026-02-24T13:00:00Z

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

+                        }
+                    }
+                    #[cfg(not(feature = "app-ethereum"))]
+                    return Err(ValidationError::Other);


Maybe add ::Disabled and map it to Error::Disabled in signtx.rs?

benma · 2026-02-24T13:00:57Z

src/rust/bitbox02-rust/src/hww/api/ethereum.rs

@@ -23,6 +23,19 @@ use pb::eth_response::Response;

 use core::convert::TryInto;

+pub(crate) fn derive_address(


Add unit tests please.

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

cedwies · 2026-02-25T10:35:24Z

Added 2 unit tests for derive_address()
Introduced AddressMismatch and Disabled error.
switched from _hal to unused_variables (not for _eth)

Ready to review again

benma

utACK

benma · 2026-02-26T08:46:38Z

src/rust/bitbox02-rust/src/hww/api/ethereum.rs

+    if !keypath::is_valid_keypath_address(keypath) {
+        return Err(Error::InvalidInput);
+    }
+    let pubkey = crate::keystore::get_xpub_twice(hal, keypath)


Mabye not worth optimizing now, but to verify the address in a payment request, deriving the xpub once is enough, as a derivation error (bit flip) will be caught and not have any bad consequence.

benma · 2026-02-26T08:49:33Z

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs

@@ -94,6 +94,10 @@ pub async fn user_verify(
 pub enum ValidationError {
    UnknownRecipient,
    InvalidSignature,
+    #[cfg(feature = "app-ethereum")]


Is there a compiler warning/error without this guard here and below? You can leave it, but imho it's fine to also not guard, as it will change whenever a new coin is supported in the coinpurchase memo.

CI complains because when app-ethereum is disabled and AddressMismatch is never constructed.

cedwies · 2026-02-26T09:01:45Z

Squashed, no change.

cedwies marked this pull request as ready for review February 11, 2026 10:32

cedwies requested a review from benma February 11, 2026 10:32

chatgpt-codex-connector bot reviewed Feb 11, 2026

View reviewed changes

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs Show resolved Hide resolved

benma reviewed Feb 11, 2026

View reviewed changes

messages/btc.proto Outdated Show resolved Hide resolved

cedwies force-pushed the cedwies/coin-purchase-memo branch from 24a5edf to ed19d60 Compare February 13, 2026 17:13

cedwies requested a review from benma February 13, 2026 17:14

benma reviewed Feb 15, 2026

View reviewed changes

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs Outdated Show resolved Hide resolved

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs Outdated Show resolved Hide resolved

cedwies force-pushed the cedwies/coin-purchase-memo branch from b666068 to 1438ce7 Compare February 16, 2026 20:09

benma requested changes Feb 17, 2026

View reviewed changes

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs Outdated Show resolved Hide resolved

benma requested changes Feb 17, 2026

View reviewed changes

src/rust/bitbox02-rust/src/hww/api/bitcoin/payment_request.rs Outdated Show resolved Hide resolved

src/rust/bitbox02-rust/Cargo.toml Outdated Show resolved Hide resolved

cedwies force-pushed the cedwies/coin-purchase-memo branch 3 times, most recently from d87fe65 to 3d9dd9e Compare February 19, 2026 15:27

cedwies requested a review from benma February 19, 2026 16:22

chatgpt-codex-connector bot reviewed Feb 19, 2026

View reviewed changes

benma reviewed Feb 24, 2026

View reviewed changes

cedwies force-pushed the cedwies/coin-purchase-memo branch from f91a5e4 to d3da007 Compare February 25, 2026 10:28

benma approved these changes Feb 26, 2026

View reviewed changes

Add coin purchase memo support

1074610

cedwies force-pushed the cedwies/coin-purchase-memo branch from d3da007 to 1074610 Compare February 26, 2026 09:01

cedwies merged commit b24d457 into BitBoxSwiss:master Feb 26, 2026
37 checks passed

		// TODO: add CoinPurchaseMemo arm when SwapKit UI is finalized
		_ => return Err(Error::InvalidInput),

		@@ -23,6 +23,19 @@ use pb::eth_response::Response;

		use core::convert::TryInto;

		pub(crate) fn derive_address(

Conversation

cedwies commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

benma commented Feb 11, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cedwies commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

benma commented Feb 15, 2026

Uh oh!

Uh oh!

Uh oh!

cedwies commented Feb 16, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cedwies commented Feb 19, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

benma Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

benma Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cedwies commented Feb 25, 2026

Uh oh!

benma left a comment

Choose a reason for hiding this comment

Uh oh!

benma Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

benma Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

cedwies Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

cedwies commented Feb 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cedwies commented Feb 11, 2026 •

edited

Loading

cedwies commented Feb 13, 2026 •

edited

Loading