onekeyhq / firmware Goto Github PK

https://onekey.so/en-US/hardware claims the firmware and bootloader are Open Source yet nowhere in the (English) documentation can I find how to verify or at least obtain the firmware binary. Furthermore the linked repository is just a text document, not mentioning "firmware", so I'm not even sure this repo is correct for this issue.

For the purpose of WalletScrutiny's review of your wallet I will have to conclude the hardware wallet uses closed source due to the missing link from the product's page to this or any other repository containing firmware source code.

Please update your product website to

• link to the correct firmware and bootloader repositories
• link to the signed binaries for every release
• document how the hardware wallet asks the user for approval, at least optionally showing the binary's hash, so the user can make sure he's installing what he wants to install

As this repository here is a fork of Trezor's firmware, I assume this is merely a documentation issue and hope to soon be able to feature your product as reproducible just like the Trezor One.

Describe the bug
After 4.5.0 firmware update, I can't send transaction on Base/Kava EVM/Linea etc. The device could only sign transaction on mainnet/bsc/avax and "already supported" chains. Any new EVM chain won't work after 4.5.0 firmware update.

Firmware version and revision
OneKey Touch 4.5.0

Desktop/smartphone setup (please complete the following information):

• Wallet software: MetaMask
• OS: macOS
• Browser: Chrome
• Version: 10.34.5

To Reproduce
Steps to reproduce the behavior:

1. Add "Base Network" on https://chainlist.org
2. Send any transaction
3. 

Expected behavior
Device show "签署 EVM 交易" and send transaction successfully.

Screenshots
Above.

Additional context
None

Describe the bug
Can't log into any website, basically, can't use my OneKey Touch (with Metamask).
Trying to sign in to any site, with Metamask, "https://connect.trezor.io/9/popup.html" pops up momentarily then closes.
Reported to support 4 weeks ago, was acknowledged as a known issue with Metamask now using Trezor v9 SDK, however I haven't seen any activity here regarding it so I'm now reporting it so it can be tracked properly.

Firmware version and revision
SafeOS 4.3.0 & OneKey App 4.9.0

Desktop/smartphone setup (please complete the following information):

• Wallet software: MetaMask 10.34.3
• OS: macOS
• Browser: Brave & Chrome
• Version: Brave 1.56.14 & Chrome 115.0.5790.170

To Reproduce
Steps to reproduce the behavior:

1. Import hardware wallet to MetaMask
2. Go to opensea.io
3. Connect wallet / go to settings
4. Attempt to sign in

Expected behavior
Hardware wallet should ask you to sign data (it doesn't)

Screenshots
N/A

Additional context
It works with OneKey browser extension (you can sign in), but I have a lot of wallets in MetaMask, and switching between MetaMask and OneKey for different wallets/sites, is convoluted.

Describe the bug
When trying to send to Kaspa, the error is "unable to decode transaction data". But the transaction is sent without problems. But I don’t see the volume and destination address.

Firmware version and revision
OneKey Classic
Firmware 3.4.0
bluetooth version 1.4.1
bootloader 2.0

Desktop/smartphone setup (please complete the following information):

• Wallet one key. Version 4.15.0 (2023110398)

To Reproduce
Just try sending KASPA to any address

Hi team,

Together with a client partner we would like to integrate a new blockchain network into the OneKey wallets.
We have went through the documentation but we haven't found any documents on how we can proceed with that. Following a discussion with your team, we were suggested to open an issue and proceed forward.

The blockchain network is - https://www.nervos.org/

The end goal is to be able to execute and sign transactions to the network via OneKey hardware wallets.

We would be happy to support with everything from our side, and we are open for discussions and communications.

Cheers.

feature request: reproducible builds

#17 was imo wasn't particularly well handled to address the concern raised.

This resulted in a "not verifiable" rating on https://walletscrutiny.com/hardware/onekey/ (which I am not affiliated with ).

https://help.onekey.so/hc/en-us/articles/6113121891599 doesn't clearly state "reproducible builds" or that users should get the same hash after complication.

All our code is open source, you can compile and generate your own binaries, and we will add HASH values in future versions.

Are binaries byte for byte deterministically reproducible, resulting in the same hash values for official and user-made builds, aka reproducible builds?

references:

• https://en.wikipedia.org/wiki/Reproducible_builds
• https://reproducible-builds.org/

Hi! Is the hardware fully open sourced? https://github.com/OneKeyHQ/firmware/tree/bixin_dev/docs/pcb - what device pcbs here?

Hi guys.
I'm interested in the question when the team will add TON blockchain (The Open Network)?