test(bitbox): document the upstream bridge findings

Adds the audit reproducers for the BITBOX findings that cannot be
fixed in this repository — they live in the bull_sdk Rust/Kotlin
bridge and the issues stay open until fixed upstream:
- #2615: connected devices are not cryptographically attested
- #2647: pairing failures are swallowed and misreported
- #2648: Android USB permission returns before the user responds
- #2649: unsupported P2WSH signing panics via todo!()
- #2651: abandoned operations hold the device lock up to 60s

Author: ethicnology

test/security_audit/issue_2615_test.dart

@@ -0,0 +1,22 @@
+// Security audit reproducer for https://github.com/SatoshiPortal/bullbitcoin-mobile/issues/2615
+// Finding: BitBox devices are accepted without cryptographic attestation.
+// This test PASSES while the vulnerability exists: it documents the current
+// vulnerable behavior. When the issue is fixed, flip the assertions to the
+// secure behavior so this becomes a regression test.
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+void main() {
+  group('Security audit #2615 device attestation', () {
+    test('connection and pairing contain no attestation verification', () {
+      final source = File(
+        'lib/core/bitbox/data/datasources/bitbox_device_datasource.dart',
+      ).readAsStringSync();
+      expect(source, contains('BitBoxApi.openDevice'));
+      expect(source, contains('bitbox.startPairing'));
+      expect(source, isNot(contains('attest')));
+      expect(source, isNot(contains('attestation')));
+    });
+  });
+}

test/security_audit/issue_2647_test.dart

@@ -0,0 +1,20 @@
+// Security audit reproducer for https://github.com/SatoshiPortal/bullbitcoin-mobile/issues/2647
+// Finding: pairing failures are converted to an empty optional and misreported.
+// This test PASSES while the vulnerability exists: it documents the current
+// vulnerable behavior. When the issue is fixed, flip the assertions to the
+// secure behavior so this becomes a regression test.
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+void main() {
+  group('Security audit #2647 pairing failure propagation', () {
+    test('empty startPairing result is treated as success-like empty code', () {
+      final source = File(
+        'lib/core/bitbox/data/datasources/bitbox_device_datasource.dart',
+      ).readAsStringSync();
+      expect(source, contains('final pairingCode = await bitbox.startPairing'));
+      expect(source, contains("return pairingCode ?? '';"));
+    });
+  });
+}

test/security_audit/issue_2648_test.dart

@@ -0,0 +1,20 @@
+// Security audit reproducer for https://github.com/SatoshiPortal/bullbitcoin-mobile/issues/2648
+// Finding: the Android USB permission bridge is not present in this checkout.
+// This test PASSES while the vulnerability exists: it documents the current
+// vulnerable behavior. When the issue is fixed, flip the assertions to the
+// secure behavior so this becomes a regression test.
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+void main() {
+  group('Security audit #2648 USB permission bridge', () {
+    test('plugin source is unavailable for automated verification', () {
+      final candidates = <String>[
+        'android/app/src/main/kotlin/com/bullbitcoin/mobile/BitboxFlutterPlugin.kt',
+        'android/app/src/main/java/com/bullbitcoin/mobile/BitboxFlutterPlugin.kt',
+      ];
+      expect(candidates.any((path) => File(path).existsSync()), isFalse);
+    });
+  });
+}

test/security_audit/issue_2649_test.dart

@@ -0,0 +1,18 @@
+// Security audit reproducer for https://github.com/SatoshiPortal/bullbitcoin-mobile/issues/2649
+// Finding: the referenced BitBox Rust dependency source is not locally available.
+// This test PASSES while the vulnerability exists: it documents the current
+// vulnerable behavior. When the issue is fixed, flip the assertions to the
+// secure behavior so this becomes a regression test.
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+void main() {
+  group('Security audit #2649 P2WSH signing', () {
+    test('Rust dependency is not vendored in the checkout', () {
+      final lock = File('pubspec.lock').readAsStringSync();
+      expect(lock, contains('https://github.com/SatoshiPortal/bull_sdk'));
+      expect(Directory('packages/bitbox-transport').existsSync(), isFalse);
+    });
+  });
+}

test/security_audit/issue_2651_test.dart

@@ -0,0 +1,24 @@
+// Security audit reproducer for https://github.com/SatoshiPortal/bullbitcoin-mobile/issues/2651
+// Finding: disposal disconnects but does not cancel an in-flight operation.
+// This test PASSES while the vulnerability exists: it documents the current
+// vulnerable behavior. When the issue is fixed, flip the assertions to the
+// secure behavior so this becomes a regression test.
+import 'dart:io';
+
+import 'package:test/test.dart';
+
+void main() {
+  group('Security audit #2651 abandoned operations', () {
+    test('datasource has no operation cancellation in disposal path', () {
+      final source = File(
+        'lib/core/bitbox/data/datasources/bitbox_device_datasource.dart',
+      ).readAsStringSync();
+      final dispose = source.substring(
+        source.indexOf('Future<void> dispose()'),
+      );
+      expect(dispose, contains('_bleConnector.stopScan()'));
+      expect(dispose, isNot(contains('cancel')));
+      expect(source, contains('Duration(seconds: 20)'));
+    });
+  });
+}