COLDCARD firmware

This update fixes a bug in the COLDCARD MK4 hardware wallet where sensitive temporary data stored in extra memory (PSRAM) was not fully erased when the device performed a 'fast wipe' or self-destruct sequence. After wiping the seed, leftover application data could remain in that memory through a reset, potentially allowing someone with physical access to recover secrets. The patch now explicitly clears that memory during both wipe paths.

This update fixes a bug where the COLDCARD Q1 wallet could accidentally let a previously authorized USB file download remain valid while it reused a special memory area (PSRAM) to prepare new data for display or signing. If a backup download lease was still active, an attacker or malicious host connected over USB might have been able to read sensitive material that was later loaded into that same memory area. The patch now clears the download lease before staging PSBT files, BBQr data, or note exports in PSRAM.

This commit fixes a security bug in the COLDCARD hardware wallet where sensitive BIP39 seed-derivation data was not being securely erased from memory after use. The patch wraps the master-secret generation in a try/finally block and uses blank_object() to wipe the mnemonic words and derived master secret even if an error occurs. Without this fix, an attacker who could read the device's RAM might recover these secrets, though such access is normally difficult on a hardened hardware wallet.

This commit fixes a small but meaningful bug in the COLDCARD bootloader. Two separate code paths that check firmware update data were missing the word 'else', so after rejecting bad data they would also run a second check. That second check could trigger an internal assertion (a hard crash/reboot) when given an invalid 'highwater' timestamp value, instead of cleanly rejecting the bad update. The fix makes the bootloader properly reject invalid values without crashing.

This commit fixes a bug in the COLDCARD firmware signing tools and headers. Previously, the maximum allowed firmware size for Mk4/Q1 devices was set too large: it did not account for a 512 KB filesystem region and a small DFU wrapper block at the end of flash. As a result, a firmware image could be signed and accepted even though part of it would extend beyond the region protected by the device's 'world checksum' integrity check. The patch shrinks the official maximum firmware length so that the entire image stays within the integrity-checked region. The changelog explicitly calls this a bugfix that 'reject[s] firmware images that extend past the world-checksum-covered flash region.'

This commit fixes a bug in the COLDCARD hardware wallet where using the BIP-85 feature while in Delta Mode could expose or operate on the real master seed instead of the expected temporary/delta seed. The fix forces the wallet to wipe the seed before performing BIP-85 derivation in Delta Mode, matching how other sensitive operations are already blocked. This is a security bugfix for a local, post-authentication edge case.

This commit fixes two ways a Coldcard in 'Delta Mode' (a restricted mode that hides the wallet seed) could still let a user pick or import secret seed phrases. One path was through 'Key Teleport' secret selection, and another was through importing a 'CCC key C' from the Seed Vault. The patch blocks both so Delta Mode cannot be bypassed to reveal or use stored secrets.

This update changes the Coldcard wallet cloning process so that the receiving device now displays the restored seed's master fingerprint and asks the user to confirm it before installing. Previously, the clone process skipped this confirmation step. The change helps prevent a user from accidentally accepting a different seed than intended during a clone, which could lead to backing up or using the wrong wallet.

This commit fixes a bug in the COLDCARD hardware wallet where a transaction could be signed over USB even if the data shown on the device screen did not match the data actually being signed. Before the fix, an attacker or buggy software could upload one PSBT (a Bitcoin transaction file) but then ask the device to sign a different one, or sign data that was not fully/correctly uploaded. The fix makes the USB signing command strictly verify the staged PSBT's length and SHA-256 hash against what is stored in memory, and resets upload state on errors so stale data cannot be reused.

This commit fixes a bug in the COLDCARD hardware wallet's staged PSBT (Partially Signed Bitcoin Transaction) signing process. Previously, the wallet only re-checked the transaction hash if something was written to the lower 'input' staging region of its external memory. Writes to the upper 'output' staging region did not trigger a re-check, meaning a malicious or buggy process could potentially modify transaction data there without detection. The fix makes the write counter cover both regions, ensures oversized transaction files are rejected before staging, and updates the signing guard so that a write to the inactive region is treated as a new baseline rather than a false alarm. In short, it closes a gap where a transaction could be tampered with after user review but before signing.

This commit only changes automated test files for the COLDCARD hardware wallet firmware. It adds small delays, extra button presses, and adjusts test parameters to make the test suite run more reliably. There are no changes to the actual firmware code that runs on the device, so this cannot affect real users or introduce security vulnerabilities.

This commit fixes a bug in the COLDCARD password-notes feature. Previously, the 'Send Password' menu option was accidentally hidden when USB was disabled, because the code reused a setting meant for something else. The fix removes that wrong condition so the option always appears. This is a usability bugfix, not a security vulnerability: it restores intended access rather than opening an unintended one.

This commit fixes a simulator-only bug in the COLDCARD firmware's development/test tooling. A special code path that simulates the secure element's 'greenlight' LED signal was writing one byte to an internal pipe instead of the expected two bytes. That single-byte write shifted all later messages out of alignment, eventually causing the simulator to crash with a Python unpacking error. The fix changes that one write to two bytes and adds a regression test to catch similar mistakes. It does not affect real COLDCARD hardware or user funds.

This commit changes which physical buttons on the COLDCARD device are treated as 'done' or 'cancel' keys during a dice-roll seed-generation feature. It makes the choice depend on the device model (QWERTY keyboard vs. non-QWERTY) instead of hardcoding a mix of keys. The change is small and appears to be a UI/UX correctness fix rather than a security vulnerability. There is no clear evidence in the commit that this fixes an exploitable bug.

This commit adds a startup safety check for the hardware random-number generator (RNG) in the COLDCARD MK4 firmware. Before anything else can use randomness, the device now verifies that the rng_get() function actually reaches the hardware RNG and returns real entropy. If the check fails, the device deliberately halts ('bricks' itself) rather than boot. The change is defensive: it does not fix a known exploit, but it is designed to prevent a future bug or supply-chain issue where the firmware might accidentally use a non-hardware (and therefore weaker) source of randomness.