COLDCARD firmware

This tiny code change fixes a likely bug in the COLDCARD's NFC feature. Previously, after an NFC operation finished and the device wiped sensitive data, the code continued running in a loop instead of stopping. The added 'break' makes it exit the loop immediately after wiping. This could prevent repeated or unnecessary NFC transmissions of sensitive wallet data, reducing the chance of leaking secrets or leaving the device in an unexpected state.

This commit is a routine test update and build timestamp refresh. It adds a new test parameter to exercise wallet-name handling with both short and long names (including spaces), and bumps the firmware build date and version. There is no security-relevant code change.

This commit fixes a Python indentation bug in the COLDCARD firmware's export function. The exception handlers for missing microSD card and write failures were placed outside the code block that actually tries to write, meaning they would never catch those errors. The fix simply indents them so they sit inside the try block. Without the fix, if a write fails, the user may see an unhandled error instead of a friendly message, and the normal cleanup/return path after a write may not run as intended.

This update fixes a user-interface crash in the COLDCARD hardware wallet when it tries to display very large QR codes. Before the change, certain long transaction outputs (for example, OP_RETURN data or unusual scripts) could make the on-device QR generator fail and throw an error, interrupting transaction review. The patch catches that failure, shows a 'QR too big' placeholder instead, and lets the user keep reviewing the transaction. It is a denial-of-service-style reliability fix rather than a theft-of-funds vulnerability.

This commit fixes a bug in the COLDCARD hardware wallet's address-ownership cache. When users tried to verify they owned an address with a very high index (near the cache limit of about 760), the first check could wrongly fail and only succeed on a second attempt. The patch also refactors how addresses are saved to the cache so exports starting in the middle of the range don't leave gaps, and it tightens BIP-21 URL parsing. The bug is a reliability issue rather than a direct theft path, but it could mislead a user into thinking a valid receive address is not theirs.

This commit is a minor cleanup and documentation update for the COLDCARD firmware. It adds a short document explaining a BIP-21 wallet parameter, replaces a hardcoded number with a named constant, tweaks on-screen text to fit smaller screens, and updates tests to match the new display strings. There is no security fix or vulnerability here.

This commit adds a new feature to Coldcard hardware wallets: when verifying ownership of a Bitcoin address, users can now include a wallet name in the BIP-21 URL (for example, bitcoin:address?wallet=my_wallet). This tells the Coldcard to search only that specific multisig wallet, rather than checking all wallets. It is a user-facing convenience feature, not a security fix, and does not appear to introduce any obvious vulnerability.

This commit is a trivial one-word edit to a changelog file. It changes a parenthetical note about a feature requiring an updated companion tool. There is no code change and no security relevance.

This commit adds a new USB command that lets a connected computer restore a COLDCARD wallet backup onto the device. The user must confirm on the device screen, and the backup file's checksum is verified. However, because restoring a backup replaces the wallet seed, the feature is security-sensitive. The commit also blocks this command in HSM (unattended signing) mode, which is a good protective measure. There is no direct evidence of a vulnerability in the patch, but the feature increases the attack surface available over USB.

This commit is just a documentation polish and a build timestamp update. It rewords the upcoming release changelog and bumps an auto-generated date/version marker in a source file. There are no code behavior changes and no security fixes or new features implemented here.

This commit adds a small new feature to the COLDCARD hardware wallet: users can now rename files stored on the device's SD card through the on-device menu. The change is a user-experience enhancement, not a security fix. It includes basic input validation to block slashes and spaces in filenames, and adds automated tests for the new behavior.

This commit changes a user-interface preference on the COLDCARD Mk4 hardware wallet: how many menu items a list must have before the up/down keys wrap around from top to bottom. The threshold is lowered from 16 to 10, matching the Q model. It is a cosmetic/UX consistency change, not a security fix.

This commit fixes a small parsing bug in how COLDCARD handles BIP-21 payment URLs (the 'bitcoin:...' links used to request payments). Previously, the code looked for a colon anywhere in the entire string to decide whether a URL protocol like 'bitcoin:' was present. Now it only checks the first 16 characters. The change also updates tests so they exercise both URLs with and without the 'bitcoin:' prefix, including one with a colon inside the label text. The bug could have caused a BIP-21 URL containing a colon later in the string—such as in a label like 'total due: 500'—to be split incorrectly, potentially misinterpreting the address or parameters.

This commit fixes a bug in the COLDCARD hardware wallet's NFC export feature. When exporting secret material (like a seed or private key) over NFC, the device was supposed to keep broadcasting the data in a loop until the user aborted or the recipient confirmed it was read. Due to a logic error, the device would wipe the temporary secret from its NFC chip after the very first loop, even though the user was still trying to export it. This meant subsequent NFC reads would fail or return nothing, making the export unreliable. The fix ensures the wipe only happens when the user actually aborts the operation.

This change moves the cleanup step that wipes sensitive data from the NFC chip so it happens when sharing is complete, rather than inside a lower-level animation routine. The old code only wiped the chip when the user aborted the NFC operation, which could mean secret data sat on the NFC chip longer than intended after a normal, successful share. The patch makes wiping happen reliably at the end of a successful share, but removes the wipe that used to occur on abort, so the security behavior depends on whether abort paths now clean up elsewhere.

This commit fixes a small bug in the COLDCARD's built-in self-test for the MicroSD card slot. The test was accidentally using the wrong value returned by a helper function, which meant the self-test could fail or behave incorrectly even though the hardware was fine. It is a routine bugfix in factory diagnostics, not a security vulnerability that attackers can exploit.

This commit is a routine version bump and changelog tidy-up for the COLDCARD firmware. It changes two Makefile version numbers (5.4.3 → 5.4.4 for Mk4, 1.3.3Q → 1.3.4Q for Q1) and rewrites the draft release notes. No code, cryptographic, or security logic is modified.

This commit makes several small changes to the COLDCARD firmware. It removes a debug print statement that exposed internal warnings, blocks certain key-teleport QR codes when the device is in a restricted 'hobbled' mode, and removes a 'has_secrets' safety check from wallet export menu items in hobbled mode. The changes appear to be hardening and UI consistency fixes rather than a clear security patch, but one change weakens an access-control predicate while others strengthen restrictions.

This commit adds a new test file with only comments and TODO items. It contains no actual code changes, no bug fixes, and no security patches. It is purely a placeholder for future tests of a 'hobble' restricted-access mode.

This commit is a minor code cleanup ('nits'). It moves a helper function, adds a comment, and removes an unused local import. There is no change to user-facing behavior or security logic.

This commit only updates user documentation. It fixes a typo in a menu path and adds a new section explaining what to do if a user forgets their 'Bypass PIN' for the Spending Policy feature: perform a factory reset via 'Destroy Seed' and restore from backup. There is no code change and no security vulnerability is being fixed.

This commit contains only trivial non-code changes: a comment rewording, a stylistic Python list change with identical behavior, a typo fix in a user-facing message, and a hyphenation fix in a test file docstring. There is no security-relevant change.

A developer added a comment in the COLDCARD MK4 bootloader code flagging that a function reads a configuration byte from a secure chip but does not check whether the read operation failed. If the read fails, the function could return an uninitialized or garbage value. This is a code-quality and potential security issue, but the patch only adds a comment—it does not fix the bug.

This commit adds a new 'hobbled mode' feature to the COLDCARD hardware wallet firmware. It lets a user set a 'Spending Policy' that restricts what the device can do even when the main PIN is entered. The policy can limit access to seed words, backups, secure notes, and certain signing operations. A special bypass PIN is required to disable or change the policy. The change is a feature addition, not a fix for a known vulnerability, and the commit message and code comments describe it as a user-controlled self-protection mechanism.

This commit changes a developer-only simulator script so that when the '--eff' flag is used, settings are kept in memory during a single run instead of being completely disabled. Previously the flag made all settings loading and saving do nothing, which meant pre-login values were lost while the simulator was running. The change makes the simulator behave more realistically for testing. It does not affect real COLDCARD hardware or production firmware.