Issue Reduction: Audit of All 80 Open Issues (Classification & Priority Table)

# Issue Reduction: Audit of All Open Issues

## Overview

As of 2026-08-30, this repository has **80 open issues**. I performed a full engineering audit of every one, reading the current codebase (upstream HEAD `3f3c831`, v1.10.3), git history, related PRs, and issue threads. A detailed evidence-based comment was posted on each issue with exact `file:line` references.

This issue serves as a **reduction index**: a single place to see the status of every open issue at a glance, grouped by classification and priority.

---

## Summary Table

| Classification | Count | Issues |
|---|---|---|
| **Still Relevant — Bugs** | 22 | #63, #82, #136, #229, #233, #234, #260, #271, #273, #277, #280, #281, #285, #286, #302, #316, #326, #355, #359, #370, #371, #393 |
| **Feature Request — Still Valuable** | 25 | #122, #153, #184, #212, #223, #232, #235, #236, #237, #238, #266, #276, #282, #289, #293, #298, #303, #312, #324, #349, #353, #357, #364, #385, #394 |
| **Feature Request — No Longer Recommended** | 7 | #81, #107, #138, #139, #290, #319, #375 |
| **Likely Fixed** (verify & close) | 10 | #132, #189, #278, #283, #288, #291, #296, #300, #308, #320 |
| **Partially Fixed** | 10 | #44, #45, #134, #141, #219, #221, #257, #279, #318, #322 |
| **Duplicate** (close & link) | 2 | #256, #328 |
| **Uncertain / Hardware Verification Needed** | 4 | #126, #162, #224, #274 |
| **Total** | **80** | |

---

## Priority Recommendations

### Highest Priority — Security & Correctness Bugs

| Issue | Title | Finding | Key Location |
|---|---|---|---|
| **#229** / **#328** | Power-loss during PIN verify wipes device | Write-before-verify + wipe-on-decrypt-failure; no atomic write | `flash.py:117-118`, `flash.py:64-69` |
| **#370** | TRNG timeout returns zeros silently | `rng_get()` returns 0 on timeout; no sanity check in `rng.py`; PR #372 open/unmerged | `src/rng.py:23-33` |
| **#234** | Anti-klepto nonce exfiltration not implemented | RFC 6979 deterministic nonces present (good vs malicious host), but no host-commitment protocol (compromised firmware could bias nonce) | `ram.py:80-88`, `libsecp256k1.c:306,448` |
| **#302** | SIGHASH_ALL appended to Schnorr signatures | Falsy-0 fallthrough resolves Taproot sighash to SIGHASH.ALL instead of DEFAULT; embit guard never triggered | `manager.py:784`, `psbtview.py:652-653` |
| **#326** | Taproot PSBT "Unknown wallet" warning + lost change verification | Wallet match fails for taproot; signing succeeds via seed-root but change-address verification is skipped | `wallet.py:167`, `ram.py:77` |
| **#281** | "Create Wallet" button creates single-sig from multisig xpub | Security-downgrade footgun: button unconditional, only single-sig descriptors offered | `xpubs.py:314-320`, `xpubs/screens.py:52` |
| **#371** | Build v1.10.3 not reproducible | `embed_git_info.py` writes environment-dependent git metadata into frozen firmware | `tools/embed_git_info.py` |
| **#277** | PSBT_TAP_KEY_SIG not supported | Vendored embit pinned to 2023-12 commit; upstream fix exists but not vendored | `psbt.py:353`, `psbtview.py:654` |

### High Priority — Functional Bugs

| Issue | Title | Finding | Key Location |
|---|---|---|---|
| **#271** | Cannot register Liana descriptor | `Miniscript.keys` is O(n²) uncached, invoked 74× during parse → MemoryError | `embit/descriptor/miniscript.py:20-25` |
| **#260** | Memory allocation with multiple wallets | All wallets eagerly loaded into RAM at init; no lazy-loading | `manager.py:86`, `manager.py:503` |
| **#273** | QR scanner error from Sparrow | No `UR:CRYPTO` routing; unbounded `payload_len` can exhaust heap | `manager.py:160`, `ur.py:29` |
| **#393** | Taproot offered for BIP-84 path | m/84h path offers `tr()` descriptor under "Other" — wrong script type | `xpubs.py:337-348` |
| **#355** | GM65 scanner reset breaks baud rate | GM65 reset branch lacks baud handling that M3Y branch has | `qr.py:601-602` vs `qr.py:586-599` |
| **#359** | SD card data cannot be deleted | No delete/secure-format on master; only open-file exists | `sd.py:16,71-100` |
| **#233** | SD card ENODEV not handled | No "format SD card" suggestion on read failure | `platform.py` |
| **#285** | Seed-QR burns into OLED | No anti-burn-in timeout; `display.off()` never called from app code | `qrcode.py:145-153`, `ram.py:396` |
| **#286** | QR scanner overheats | No auto-timeout; hardware timeout explicitly disabled | `qr.py:786,397,103-104` |
| **#136** | Host command not recognized | Intermittent parse failure; requires investigation | `manager.py` |
| **#82** | Scanner doesn't start if PIN entered too fast | Scanner init race with PIN entry | `specter.py` |
| **#63** | Fee attack on segwit | Partially mitigated; high-fee warning still missing (#324) | `transaction.py:76-88` |

### Medium Priority — UX / Minor Bugs

| Issue | Title | Finding | Key Location |
|---|---|---|---|
| **#280** | Bit values in wrong order (ascending 1→1024) | Never touched; fix must reverse labels AND toggle logic | `mnemonic.py:93-94,133-136` |
| **#316** | P2TR question (answer: yes, with caveats) | Dead `experimental.taproot` config written but never read | `specter.py:540` |
| **#322** | Account indexing confusion | Derivation paths not shown in default menu | `xpubs.py:76` |

### Likely Fixed — Verify & Close

| Issue | Title | Evidence | Related PR |
|---|---|---|---|
| **#283** | Locktime/blockheight display | nLockTime + nSequence added to confirmation screen | #321 (`3d1bb8e`) |
| **#288** | False seed words from Compact SeedQR | GM65 RAW mode detection + factory reset on boot | #299 (`031d285`), #335 (`97ab4d4`) |
| **#320** | QR Code PSBT troubleshoot | UART buffer 2048→4096 + EOL frame validation + M3Y support | #335 (`97ab4d4`) |
| **#300** | Host error with Sparrow (M3Y) | Full M3Y scanner support added | #335 (`97ab4d4`) |
| **#296** | Build broken Ubuntu 24.04 | `-Wno-dangling-pointer` added to CFLAGS | #301 (`a5c9926`), #325 (`a239557`) |
| **#308** | docs.specter.solutions restored | Live site verified 2026-08-30 | cryptoadvance/docs |
| **#278** / **#291** | GPG key expired | Rotated to "Specter Signer 2026" key (k9ert) | v1.10.3 |
| **#132** | PIN font size | PIN font enlarged; broader font setting = #236 | — |
| **#189** | Simulator doesn't work | Simulator runs on current build | — |

### Duplicates — Close & Link

| Issue | Duplicate Of | Reason |
|---|---|---|
| **#256** | #234 | Same topic: RFC 6979 + anti-klepto; #234 is implementation ticket |
| **#328** | #229 | Same root cause: power-loss wipe; flash write-before-verify |

---

## Feature Requests — Still Valuable

Grouped by theme:

**Wallet & Address Management:**
| Issue | Title | Notes |
|---|---|---|
| #237 | Store addresses for lookup | Enables #303/#318; fixes brute-force slowness |
| #303 | Verify address from QR | Needs index-free routing; coordinate with #237 |
| #318 | USB address verification | showaddr rejects `tr`; needs wallet-name+index command |
| #385 | Create multisig descriptor | Only single-sig offered; would fix #281 footgun |
| #282 | Browse change addresses | WalletScreen already supports branch=1; needs menu toggle |
| #364 | Mark receive addresses as used | Manual mark action; currently only auto-advanced by PSBT |
| #349 | Recovery tool for unknown derivations | Derivation-sweep tool; must not call `set_mnemonic` |

**Signing & PSBT:**
| Issue | Title | Notes |
|---|---|---|
| #234 | Anti-klepto protocol | See security section above |
| #289 | Silent Payments support | Primitives available; large new wallet type |
| #394 | Mempool push QR | Optional raw-tx QR alongside signed PSBT |
| #324 | High fee warning | Use existing `meta["warnings"]` path |

**Seed & Backup:**
| Issue | Title | Notes |
|---|---|---|
| #232 | Password-encrypted seed export | AEAD + password; companion to existing SD export |
| #353 | SLIP-39 Shamir sharing | embit has split/recover; needs new card applet |
| #212 | SeedQR transcription mode | Partially fixed; landscape mode still missing |
| #223 | Recovery phrase UX | Duplicate of #45; needs "Previous word" button |
| #238 | Base43 encoding | Scope to plaintext seed import; PSBT-over-base43 is legacy |

**Communication & Encoding:**
| Issue | Title | Notes |
|---|---|---|
| #357 | BlueWallet export format | Parse proprietary plain-text multisig setup file |
| #276 | NFC support | Upstream-blocked (needs specter-javacard applet) |
| #266 | Encryption/decryption app | All primitives present (ECDH+AEAD); companion to #184 |
| #184 | Message encryption | Companion to #266 |

**UI & Settings:**
| Issue | Title | Notes |
|---|---|---|
| #236 | Font size setting | LVGL already compiles 12/16/22/28; discrete setting feasible |
| #293 / #298 | Language selection | No i18n infrastructure; needs `t()` + translation tables |
| #312 | UI/menu restructure | Prototyped in k9ert/specter-playground; needs implementation |
| #122 | Import wallet from transaction | Derive descriptor from signed tx |
| #153 | Multisig message signing | Needs cosigners app |
| #235 | Fully stateless mode | Large architectural work; no persistence mode |
| #45 | Recovery screen improvements | Autocomplete done; landscape/swipe not done |

---

## Feature Requests — No Longer Recommended

| Issue | Title | Reason |
|---|---|---|
| #81 | Import aezeed (LND) | Niche format; BIP39 is standard |
| #107 | Yubikey support | Conflicts with hardware signer model |
| #138 | TOTP app | No reliable time source on device |
| #139 | DIY HSM | Conflicts with verify-every-tx model |
| #290 | Payjoin V2 | Transport belongs in host wallet, not hardware signer |
| #319 | Add to WalletsRecovery.org | External website task, not firmware code |
| #375 | Dice rolls as entropy | Existing bit-editing UI (#109) already provides user-controlled entropy |

---

## Cross-Issue Relationships

| Relationship | Issues | Description |
|---|---|---|
| Power-loss wipe | #229 ↔ #328 | Same root cause; #328 is duplicate of #229 |
| Anti-klepto | #234 ↔ #256 | Same topic; #256 is duplicate of #234 |
| Scanner init race | #82 ↔ #126 ↔ #134 | Intermittent scanner startup issues |
| Recovery UX | #45 ↔ #223 | Duplicate; both request recovery screen improvements |
| SD card ENODEV | #44 ↔ #233 | SD card read failures |
| Encryption app | #184 ↔ #266 | Companions; both need ECDH+AEAD primitives |
| Password seed export | #232 ↔ #226 | Related seed export features |
| Address verification | #237 ↔ #303 ↔ #318 | Cache enables QR + USB verification |
| Multisig footgun | #281 ↔ #385 | Implementing #385 (multisig creation) fixes #281 footgun |
| Language/i18n | #293 ↔ #298 | Duplicates; consolidate into single issue |
| GPG key | #278 ↔ #291 | Duplicates; both resolved by key rotation in v1.10.3 |
| Taproot signing | #277 ↔ #302 ↔ #326 | Related taproot PSBT handling bugs |
| GM65 scanner | #288 ↔ #300 ↔ #320 ↔ #355 | Related GM65/M3Y scanner fixes from #299/#335 |
| Fee display | #63 ↔ #324 | Fee attack mitigation + high-fee warning |
| Font/UI | #132 ↔ #236 ↔ #293 | Related UI/font/language settings |

---

## Methodology

- **Audit snapshot:** 2026-08-29, upstream HEAD `3f3c831` (v1.10.3)
- Each issue was investigated against the current codebase with `file:line` citations
- Git history checked for related commits and merged PRs
- Related issues cross-referenced via GitHub search
- Security findings assessed per-issue; novel undisclosed vulnerabilities reported privately
- Classifications distinguish **tested** (reproduced/simulator-verified) vs **inferred** (code inspection) vs **not-reproduced** (hardware-only)

## Notes

- **Hardware verification not performed** — several issues (#162, #224, #274, #300, #355) need on-device testing to confirm
- A **private security ledger** is maintained for findings not yet disclosed publicly
- Each issue has a detailed comment with full evidence; this issue is the reduction index

Start with the audit snapshot, summary table, and per-issue comments, then verify the cited file:line references such as flash.py, src/rng.py, manager.py, and tools/embed_git_info.py. Check each classification against the current issue and pull-request state; done means the reduction index is accurate and outdated, duplicate, or fixed entries are identified.

Written by the indexing model from the issue text.