OSC-2026-0024 · github.com/diybitcoinhardware/embit
info clean-run grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/diybitcoinhardware/embit
- Commit
- fff7ffa43f6ce088c5ba22cb3877a122bf01dc96
- Scope path
- src/embit/psbt.py
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/tx-authorization-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- 4c538d33477fc3bf33be2409b4fb5170d4a97732e17b5990eaaa6dbdcff4a127
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent Grok re-audit of transaction-authorization class on embit at fff7ffa4. In scope: whether the library performs change-output verification, fee-attack protection (opt-in?), PSBT parser robustness. NOT: display, firmware, downstream apps. Cross-model counterpart to OSC-2026-0012.
Findings
info OSC-2026-0024-F1 unreviewed
No defect found; central change check is intentionally absent at the library layer. PSBT.sign_with derives keys and signs without classifying change; Descriptor.owns and examples/change.py document app-side verification. InputScope.verify / PSBT.verify exist for fee-attack protection but are opt-in (sign_with does not require is_verified). Parser rejects bad magic, duplicate keys, and truncated fields. Downstream apps (e.g. SeedSigner) must implement authorization — this record documents the boundary. Agreement with OSC-2026-0012.