CommitWatch RSS
CK
← All projectsCoinkite

COLDCARD firmware

Open-source firmware for COLDCARD Bitcoin signing devices.

BitcoinHardware walletsActive incident
Source repository ↗
Repository coverage

468 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

137security candidates209second-pass queue413AI analyses
55commits · 30 days
184commits · 60 days
253commits · 180 days
377commits · 365 days
Backfill bands
Aug 5 → Feb 6148 seen2 candidatesComplete
Feb 6 → Jun 684 seen8 candidatesComplete
Jun 6 → Jul 649 seen4 candidatesComplete
Jul 6 → Aug 525 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

36/100 average clarity
10Strong · 80–100
45Adequate · 60–79
195Thin · 40–59
218Opaque · 0–39
42security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
scgbckbone2551112271643
Peter D. Gray17020162818
Dmitry Monakhov212173
@Bibo-dochex923042
kdmukai111050
doc-hex111073
Piotr Duszynski111073
tadeubas606051
copilot-swe-agent[bot]504072
Danilo500079
hitechhayekian301081
Copilot300074
Analysis record

Published AI watches

Last scanned 45 minutes ago

Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 91 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add regression test for non-object JSON message-sign input

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list)…

Regression test for input validation of JSON message-signingTest comment explicitly references avoiding a device crash on malformed JSON inputTest requested during review of pull request #808, suggesting prior related code change
adb7baa8by copilot-swe-agent[bot]+32−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

hygiene: duress wallet activate - wipe before getting slot data

This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in …

secret-handling order-of-operations changeDelta Mode coercer/wipe scenarioduress wallet secret loading
aa645247by scgbckbone+3−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

OVC clear stale outputs from new_outputs

This firmware update fixes a cleanup issue in the COLDCARD wallet's transaction signing code. Before finalizing a new Bitcoin transaction, the device now clears out leftover 'change output' records that may have been captured during a prev…

State not reset between signing attemptsStale change-output metadata reused in transaction finalizationOVC (Output Value Check) validation may be affected by leftover data
62163ccdby scgbckbone+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Drop ValueError message string to save flash space

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still…

dc89513cby copilot-swe-agent[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add changelog entry for msgsign JSON crash fix

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). …

Device crash on malformed message-signing inputInput vector includes NFC, QR, and SD card JSON filesValid JSON but wrong type (non-object) bypasses simple format checks
07afee0dby copilot-swe-agent[bot]+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix uncaught AttributeError on non-object JSON in parse_msg_sign_request

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix ch…

uncaught exception in message parsing pathinput validation gap on JSON typepotential denial-of-service via malformed request
d55ddbceby copilot-swe-agent[bot]+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for mk release.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes,…

e6d01c36by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for q1 release.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, an…

a310e1ddby Peter D. Gray+16−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

3caf599eby Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new policy w blank lines

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code …

3d8f90f1by Peter D. Gray+9−561 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update for new release

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q,…

USB protocol encryption upgrade (ncry v3) with direction-separated keys and replay protectionPSBT tampering detection: re-verify staged bytes before signing after Virtual Disk overwriteFirmware update integrity: abort if staged image overwritten, reject images extending past world-checksum region
ea2b89bfby Peter D. Gray+272−1124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

15deb2f6by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: report staged firmware modification at upgrade approval

This commit fixes a bug in the COLDCARD firmware upgrade process. Previously, if someone tampered with the staged firmware after the user saw the approval prompt but before they confirmed, the device would crash with a bare internal error …

Tamper-detection failure path hardened: assert replaced with user-facing failure storyDefense-in-depth assertion added to PIN-changing flowTest coverage added for tamper-abort message
ef73cf58by scgbckbone+6−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bump ckcc to latest master

This commit only updates a linked external code library (a Git submodule called ckcc-protocol) to a newer version. The actual code changes inside that library are not shown in the commit diff, and no security-related information was provid…

ec1c9417by scgbckbone+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

tweaks

This commit only edits the draft release changelog file. It rewords two upcoming feature descriptions and fixes line wrapping for another entry. No source code, firmware logic, or security behavior was changed.

e166ffddby Peter D. Gray+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: reject non-ASCII BIP-39 passphrases

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters diff…

Behavioral fix that prevents silent derivation of incompatible wallet seedsInput validation added for BIP-39 passphrase across USB, UI, saved-passphrase restore, and note/password lanesRejection of non-printable ASCII and non-ASCII Unicode characters
c1a67660by scgbckbone+155−147 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 74 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: capture single-sig segwit change

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a tr…

Fixes deferred persistence of UTXO amount cache until after successful signingFixes missing capture of single-sig segwit change outputs (p2wpkh and p2sh-p2wpkh)Prevents cache poisoning by cancelled/malicious PSBT previews
8979a8a5by scgbckbone+322−806 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Reject duplicate singleton PSBT keys

This update fixes a bug in how the COLDCARD wallet reads PSBT files (the standard format for passing Bitcoin transactions between devices). Previously, if a PSBT contained the same special 'singleton' key twice in the same section, the dev…

PSBT parser now rejects duplicate singleton keysNew test cases for duplicate keys in global/input/output mapsChangelog labels the change as a bugfix
cb6df8daby scgbckbone+30−13 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatenitsby scgbckbone · 0420d4b6 · Sep 16, 2025 · 4 filesMessage 0 · OpaqueLow 43Details
Commit message · scgbckbone

nits

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
authentication path
AI analysis · Low 43/100

This commit fixes a PIN-uniqueness check in the COLDCARD's 'Seed Vault / Secure Spending Policy' setup. Previously, when a user picked an unlock PIN, the code only compared it against the main PIN and visible 'trick' PINs, but missed hidden trick PINs. That could let the same PIN be used for two different security features, which can cause confusion or allow a hidden trick PIN to silently override the intended unlock behavior. The patch now asks the secure element (SE2) whether the PIN is already in use anywhere before accepting it.

AI review queuedtidyby Peter D. Gray · 00b2f67d · Sep 16, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

tidy

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only cleans up automated test code. It turns a shared test helper into a fixture that automatically resets test state after each test, removing duplicated cleanup lines from several tests. There is no change to the actual COLDCARD firmware or any user-facing behavior.

AI review queuedtest casesby Peter D. Gray · d053398a · Sep 16, 2025 · 4 filesMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

test cases

0/100 · OpaqueMessage clarity
✓ Mentions testing or verification! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds and updates automated test code for the COLDCARD firmware's 'hobble' restricted-access mode and related features (secure notes, NFC, key teleport). It does not change any firmware source code that runs on the device, so it cannot by itself introduce a security vulnerability or fix one in shipped code.

Security candidatetest deltamode worksby Peter D. Gray · 7daa67cc · Sep 16, 2025 · 4 filesMessage 38 · OpaqueInformational 15Details
Commit message · Peter D. Gray

test deltamode works

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
access control
AI analysis · Informational 15/100

This commit only adds automated tests for an existing firmware feature called 'deltamode' trick PINs. It does not change the actual COLDCARD firmware code that users run. The tests confirm that when a deltamode trick PIN is active, the device produces an intentionally invalid Bitcoin signature and does not wipe the seed. No security bug is introduced or fixed here.

AI review queuedreword last_fail_reasonby Peter D. Gray · 335df666 · Sep 16, 2025 · 1 fileMessage 18 · OpaqueLow 38Details
Commit message · Peter D. Gray

reword last_fail_reason

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 38/100

This commit reworks how the COLDCARD wallet records why a spending policy was rejected. Previously the reason was stored only in memory, so it disappeared when the device was powered off. Now it is saved to device settings, letting the owner view the reason after restarting. The change also fixes a few related bugs, such as a menu accidentally showing the wrong policy and missing parentheses on some 'is enabled' checks. There is no direct evidence in the commit that this fixes an active security vulnerability, but it improves reliability and auditability of policy enforcement.

AI review queuedtuneby Peter D. Gray · 4bd8d12d · Sep 16, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

tune

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit adds a short 0.2-second delay inside a test file for the COLDCARD firmware. It is a test-only timing tweak and does not change any production firmware code, wallet behavior, or security logic.

AI review queuedmoreby Peter D. Gray · a4c7f95d · Sep 16, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

more

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds a one-line note to a test file describing a future test case. No actual code, fix, or behavior change is present in the diff.

Security candidatebugfix: enter vfs after creating itby scgbckbone · 9a4d3986 · Sep 16, 2025 · 4 filesMessage 45 · ThinLow 41Details
Commit message · scgbckbone

bugfix: enter vfs after creating it

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy path
AI analysis · Low 41/100

This commit fixes a bug where the COLDCARD device's internal flash filesystem was created but not properly entered before trying to create a settings folder. As a result, the folder could be created in the wrong place or the filesystem setup could fail. The fix changes the code to enter the new filesystem first, then create the folder. A related change removes an extra argument when wiping the filesystem during seed operations, and adds a confirmation-key requirement to the filesystem wipe command to reduce accidental use.

AI review queuedslip32 --> slip132by scgbckbone · f89061ff · Sep 4, 2025 · 5 filesMessage 18 · OpaqueInformational 15Details
Commit message · scgbckbone

slip32 --> slip132

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple cleanup rename from 'SLIP-32' to 'SLIP-132' plus a typo fix. SLIP-32 was a mistaken label; the actual Bitcoin standard for versioned extended keys is SLIP-132. No behavior changed, and no security issue is present.

Security candidateClarify allowed usage of Seed XOR standard and nameby kdmukai · 3eb99272 · Aug 29, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · kdmukai

Clarify allowed usage of Seed XOR standard and name

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only adds a short paragraph to documentation stating that Seed XOR is an open standard and that others may use the name and implement it freely. There is no code change, no security fix, and no vulnerability.

AI review queuednarrowerby nvk · 56e5b984 · Aug 18, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · nvk

narrower

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit changes a small monochrome arrow/checkmark graphic in the COLDCARD firmware. The old shape was a narrow pointer; the new shape is a slightly different narrow pointer using different ASCII characters. There is no code change, no security behavior change, and no indication this fixes or introduces a vulnerability.

AI review queuedfix HSM UX message textby scgbckbone · 123caec8 · Aug 13, 2025 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · scgbckbone

fix HSM UX message text

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit fixes a typo in a user-facing message shown by the COLDCARD's HSM (Hardware Security Module) policy screen. The phrase 'Address values values will be shared' is corrected to 'Address values will be shared'. There is no security impact.

Lower-priorityKey Teleport easier to accessby Peter D. Gray · 637624de · Aug 11, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Peter D. Gray

Key Teleport easier to access

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds a new menu option called 'Key Teleport (start)' to the COLDCARD wallet's startup screen, making an existing feature easier to find and access. There is no code change that fixes a bug, closes a security hole, or alters how the feature works. It is purely a user-interface convenience change.