OSC-2026-0030 · github.com/proto-at-block/bitkey
none-found clean-run grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/proto-at-block/bitkey
- Commit
- cf16705543d0c66ff982635733d380944cc2677d
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/tx-authorization-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- d5da107f471190a1b5a9a94137fdf34c2ea41cb94048626a88b67e5b0a6a65f0
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent tx-authorization audit of bitkey at cf167055. In scope: w3-core raw_tx and streaming sign flows, wallet_change_output_belongs_to_policy (full 2-of-3 P2WSH SPK re-derive), session commitment hash at confirm vs sign, BIP-143 amount binding, fee/send display, receive address derivation, FWUP verify-before-commit. Out of scope: mobile app UI, server cosigner, non-w3-core images. Same commit as OSC-2026-0028 entropy run; different lens.
Findings
none-found OSC-2026-0030-F1 unreviewed
No transaction-authorization defect found in scope on production w3-core signing. Change outputs flagged with a derivation path are re-derived as 2-of-3 P2WSH from the stored keyset and must match scriptPubKey or signing is refused. Session hash binds displayed tx to signed bytes. Input amounts bind via BIP-143; fee is computed and shown. Firmware updates verify signature before committing signature to flash.