Key derivation hardening

.github/workflows/guidelines_enforcer.yml

@@ -20,4 +20,4 @@ on:
 jobs:
   guidelines_enforcer:
     name: Call Ledger guidelines_enforcer
-    uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_guidelines_enforcer.yml@v1
+    uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_guidelines_enforcer.yml@app-bitcoin-legacy-hardening

CHANGELOG.md

@@ -5,11 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
-## [2.4.10] - 2025-11-07
+## [2.4.10] - 2026-02-19
 
 ### Modified
 
-- Ticker moved on the right
+- Derivation Path Hardening:
+    - `HAVE_APPLICATION_FLAG_DERIVE_MASTER` is removed for all coins except Bitcoin Legacy and Bitcoin Test Legacy
+    - BIP-32 derivation paths are enforced using wildcard syntax (`m/*/<COIN_TYPE>`), with a few exceptions for Bitcoin forks
+- Ticker moved on the right.
 
 ## [2.4.9] - 2025-09-08
 

Makefile

@@ -54,6 +54,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"tb\"
 COIN_KIND=COIN_KIND_BITCOIN_TESTNET
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Bitcoin Test Legacy"
+HAVE_APPLICATION_FLAG_DERIVE_MASTER = 1
 
 else ifeq ($(COIN),bitcoin_legacy)
 # Horizen
@@ -64,11 +65,14 @@ COIN_P2SH_VERSION=5
 COIN_FAMILY=1
 COIN_COINID=\"Bitcoin\"
 COIN_COINID_NAME="Bitcoin"
+COIN_TAGLINE1="This is a recovery tool."
+COIN_TAGLINE2="Not for everyday use!"
 COIN_COINID_SHORT=\"BTC\"
 COIN_NATIVE_SEGWIT_PREFIX=\"bc\"
 COIN_KIND=COIN_KIND_BITCOIN
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Bitcoin Legacy"
+HAVE_APPLICATION_FLAG_DERIVE_MASTER = 1
 
 else ifeq ($(COIN),bitcoin_cash)
 # Bitcoin cash
@@ -84,6 +88,7 @@ COIN_COINID_SHORT=\"BCH\"
 COIN_KIND=COIN_KIND_BITCOIN_CASH
 COIN_FORKID=0
 APPNAME ="Bitcoin Cash"
+PATH_APP_LOAD_PARAMS = "*/145'" "*/0'" "4541509'" "45'"
 
 else ifeq ($(COIN),bitcoin_gold)
 # Bitcoin Gold
@@ -100,6 +105,7 @@ COIN_KIND=COIN_KIND_BITCOIN_GOLD
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 COIN_FORKID=79
 APPNAME ="Bitcoin Gold"
+PATH_APP_LOAD_PARAMS = "*/156'" "*/0'" "4541509'" "45'"
 
 else ifeq ($(COIN),litecoin)
 # Litecoin
@@ -115,6 +121,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"ltc\"
 COIN_KIND=COIN_KIND_LITECOIN
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Litecoin"
+PATH_APP_LOAD_PARAMS = "*/2'"
 
 else ifeq ($(COIN),dogecoin)
 # Doge
@@ -128,6 +135,7 @@ COIN_COINID_NAME="Doge"
 COIN_COINID_SHORT=\"DOGE\"
 COIN_KIND=COIN_KIND_DOGE
 APPNAME ="Dogecoin"
+PATH_APP_LOAD_PARAMS = "*/3'"
 
 else ifeq ($(COIN),dash)
 # Dash
@@ -141,22 +149,7 @@ COIN_COINID_NAME="Dash"
 COIN_COINID_SHORT=\"DASH\"
 COIN_KIND=COIN_KIND_DASH
 APPNAME ="Dash"
-
-else ifeq ($(COIN),zcash)
-# Zcash (deprecated, code before the NU5 hard fork)
-$(error the zcash variant is deprecated and no longer functional since the NU5 hard fork)
-BIP44_COIN_TYPE=133
-BIP44_COIN_TYPE_2=133
-COIN_P2PKH_VERSION=7352
-COIN_P2SH_VERSION=7357
-COIN_FAMILY=1
-COIN_COINID=\"Zcash\"
-COIN_COINID_NAME="Zcash"
-COIN_COINID_SHORT=\"ZEC\"
-COIN_KIND=COIN_KIND_ZCASH
-# Switch to Canopy over Heartwood
-BRANCH_ID=0xE9FF75A6
-APPNAME ="Zcash"
+PATH_APP_LOAD_PARAMS = "*/5'"
 
 else ifeq ($(COIN),horizen)
 # Horizen
@@ -170,6 +163,7 @@ COIN_COINID_NAME="Horizen"
 COIN_COINID_SHORT=\"ZEN\"
 COIN_KIND=COIN_KIND_HORIZEN
 APPNAME ="Horizen"
+PATH_APP_LOAD_PARAMS = "*/121'"
 
 else ifeq ($(COIN),komodo)
 # Komodo
@@ -183,6 +177,7 @@ COIN_COINID_NAME="Komodo"
 COIN_COINID_SHORT=\"KMD\"
 COIN_KIND=COIN_KIND_KOMODO
 APPNAME ="Komodo"
+PATH_APP_LOAD_PARAMS = "*/141'"
 
 else ifeq ($(COIN),stratis)
 # Stratis
@@ -197,6 +192,7 @@ COIN_COINID_SHORT=\"STRAX\"
 COIN_KIND=COIN_KIND_STRATIS
 COIN_FLAGS=FLAG_PEERCOIN_SUPPORT
 APPNAME ="Stratis"
+PATH_APP_LOAD_PARAMS = "*/105105'"
 
 else ifeq ($(COIN),xrhodium)
 #Xrhodium
@@ -210,6 +206,7 @@ COIN_COINID_NAME="xRhodium"
 COIN_COINID_SHORT=\"XRC\"
 COIN_KIND=COIN_KIND_XRHODIUM
 APPNAME ="xRhodium"
+PATH_APP_LOAD_PARAMS = "*/10291'"
 
 else ifeq ($(COIN),peercoin)
 # Peercoin
@@ -224,6 +221,7 @@ COIN_COINID_SHORT=\"PPC\"
 COIN_KIND=COIN_KIND_PEERCOIN
 COIN_FLAGS=FLAG_PEERCOIN_UNITS\|FLAG_PEERCOIN_SUPPORT
 APPNAME ="Peercoin"
+PATH_APP_LOAD_PARAMS = "*/6'"
 
 else ifeq ($(COIN),pivx)
 # PivX
@@ -238,6 +236,7 @@ COIN_COINID_NAME="PivX"
 COIN_COINID_SHORT=\"PIVX\"
 COIN_KIND=COIN_KIND_PIVX
 APPNAME ="PivX"
+PATH_APP_LOAD_PARAMS = "*/119'" "*/77'"
 
 else ifeq ($(COIN),viacoin)
 # Viacoin
@@ -252,6 +251,7 @@ COIN_COINID_SHORT=\"VIA\"
 COIN_KIND=COIN_KIND_VIACOIN
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Viacoin"
+PATH_APP_LOAD_PARAMS = "*/14'"
 
 else ifeq ($(COIN),vertcoin)
 # Vertcoin
@@ -268,6 +268,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"vtc\"
 COIN_KIND=COIN_KIND_VERTCOIN
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Vertcoin"
+PATH_APP_LOAD_PARAMS = "*/28'" "*/128'"
 
 else ifeq ($(COIN),digibyte)
 BIP44_COIN_TYPE=20
@@ -282,9 +283,8 @@ COIN_NATIVE_SEGWIT_PREFIX=\"dgb\"
 COIN_KIND=COIN_KIND_DIGIBYTE
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Digibyte"
+PATH_APP_LOAD_PARAMS = "*/20'"
 
-else ifeq ($(COIN),qtum)
-$(error the qtum variant is deprecated and has been moved to its dedicated repo)
 else ifeq ($(COIN),firo)
 BIP44_COIN_TYPE=136
 BIP44_COIN_TYPE_2=136
@@ -296,6 +296,7 @@ COIN_COINID_NAME="Firo"
 COIN_COINID_SHORT=\"FIRO\"
 COIN_KIND=COIN_KIND_FIRO
 APPNAME ="Firo"
+PATH_APP_LOAD_PARAMS = "*/136'"
 
 else ifeq ($(COIN),bitcoin_private)
 # Bitcoin Private
@@ -312,6 +313,7 @@ COIN_COINID_SHORT=\"BTCP\"
 COIN_KIND=COIN_KIND_BITCOIN_PRIVATE
 COIN_FORKID=42
 APPNAME ="Bitcoin Private"
+PATH_APP_LOAD_PARAMS = "*/183'" "*/0'" "4541509'" "45'"
 
 else ifeq ($(COIN),gamecredits)
 # GameCredits
@@ -326,6 +328,7 @@ COIN_COINID_SHORT=\"GAME\"
 COIN_KIND=COIN_KIND_GAMECREDITS
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="GameCredits"
+PATH_APP_LOAD_PARAMS = "*/101'"
 
 else ifeq ($(COIN),zclassic)
 # ZClassic
@@ -339,6 +342,7 @@ COIN_COINID_NAME="ZClassic"
 COIN_COINID_SHORT=\"ZCL\"
 COIN_KIND=COIN_KIND_ZCLASSIC
 APPNAME ="ZClassic"
+PATH_APP_LOAD_PARAMS = "*/147'"
 
 else ifeq ($(COIN),nix)
 # NIX
@@ -354,6 +358,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"nix\"
 COIN_KIND=COIN_KIND_NIX
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="NIX"
+PATH_APP_LOAD_PARAMS = "*/400'"
 
 else ifeq ($(COIN),lbry)
 # LBRY
@@ -367,6 +372,7 @@ COIN_COINID_NAME="LBRY"
 COIN_COINID_SHORT=\"LBC\"
 COIN_KIND=COIN_KIND_LBRY
 APPNAME ="LBRY"
+PATH_APP_LOAD_PARAMS = "*/140'"
 
 else ifeq ($(COIN),resistance)
 # Resistance
@@ -380,6 +386,7 @@ COIN_COINID_NAME="Resistance"
 COIN_COINID_SHORT=\"RES\"
 COIN_KIND=COIN_KIND_RESISTANCE
 APPNAME ="Resistance"
+PATH_APP_LOAD_PARAMS = "*/356'"
 
 else ifeq ($(COIN),ravencoin)
 # Ravencoin
@@ -393,6 +400,7 @@ COIN_COINID_NAME="Ravencoin"
 COIN_COINID_SHORT=\"RVN\"
 COIN_KIND=COIN_KIND_RAVENCOIN
 APPNAME ="Ravencoin"
+PATH_APP_LOAD_PARAMS = "*/175'"
 
 else ifeq ($(COIN),hydra_testnet)
 # Hydra testnet
@@ -408,7 +416,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"hc\"
 COIN_KIND=COIN_KIND_HYDRA
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Hydra Test"
-APP_LOAD_PARAMS += --path "44'/609'"
+PATH_APP_LOAD_PARAMS = "44'/609'"
 
 else ifeq ($(COIN),hydra)
 # Hydra mainnet
@@ -424,7 +432,7 @@ COIN_NATIVE_SEGWIT_PREFIX=\"hc\"
 COIN_KIND=COIN_KIND_HYDRA
 COIN_FLAGS=FLAG_SEGWIT_CHANGE_SUPPORT
 APPNAME ="Hydra"
-APP_LOAD_PARAMS += --path "44'/609'"
+PATH_APP_LOAD_PARAMS = "44'/609'"
 
 else ifeq ($(filter clean,$(MAKECMDGOALS)),)
 $(error Unsupported COIN - use $(VARIANT_VALUES))