OpenSourceCheck

OSC-2026-0024 · github.com/diybitcoinhardware/embit

info clean-run grok-4.5 2026-08-04 signed: nostr

Repository
github.com/diybitcoinhardware/embit
Commit
fff7ffa43f6ce088c5ba22cb3877a122bf01dc96
Scope path
src/embit/psbt.py
Model
grok-4.5
Harness
grok-build
Prompts
prompts/tx-authorization-audit-v1.md
Independent runs
1
Transcript sha256
4c538d33477fc3bf33be2409b4fb5170d4a97732e17b5990eaaa6dbdcff4a127
Auditor
TheIcarusWings (theicaruswings)
Signature
nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5

Scope. Independent Grok re-audit of transaction-authorization class on embit at fff7ffa4. In scope: whether the library performs change-output verification, fee-attack protection (opt-in?), PSBT parser robustness. NOT: display, firmware, downstream apps. Cross-model counterpart to OSC-2026-0012.

Findings

info OSC-2026-0024-F1 unreviewed

No defect found; central change check is intentionally absent at the library layer. PSBT.sign_with derives keys and signs without classifying change; Descriptor.owns and examples/change.py document app-side verification. InputScope.verify / PSBT.verify exist for fee-attack protection but are opt-in (sign_with does not require is_verified). Parser rejects bad magic, duplicate keys, and truncated fields. Downstream apps (e.g. SeedSigner) must implement authorization — this record documents the boundary. Agreement with OSC-2026-0012.

src/embit/psbt.py:226-246,683-704,934-1069; src/embit/descriptor/descriptor.py:204-234