COLDCARD firmware

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should have none, badly encoded input/output counts, and PSBTv2 files that are missing the required global version field. These are defensive hardening fixes rather than a single obvious exploit, but they close paths where a malicious or malformed PSBT could confuse the wallet's transaction parser.

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transaction lock time from these per-input requirements, which could cause it to sign transactions with the wrong lock time or reject valid ones. The patch implements the BIP-370 rule: if any input requires a lock time, the transaction's final lock time must be the most restrictive (maximum) of those requirements, overriding any fallback. This is a correctness/feature fix rather than a remote exploit, but incorrect lock-time handling could in theory let a malicious co-signer or wallet software trick a user into signing a transaction that becomes spendable earlier or later than expected.

This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in which sensitive wallet data could remain in memory if the device is in Delta Mode (a limited, coerced-access mode). There is no direct evidence in the commit that an actual leak was exploited; it reads as a precautionary hardening change.

This commit fixes a bug in the COLDCARD firmware upgrade process. Previously, if someone tampered with the staged firmware after the user saw the approval prompt but before they confirmed, the device would crash with a bare internal error (assert). Now it cleanly aborts and tells the user 'Firmware modified'. The commit also adds a small extra safety check in the main PIN change flow to ensure no temporary wallet is active, and updates tests accordingly.

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters differently, the same passphrase could silently produce a different wallet address on COLDCARD than on another app. The fix now rejects those passphrases outright, preventing users from accidentally creating funds they later cannot access or reconcile with other wallets.

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a transaction was previewed, even if the user later cancelled without signing. A malicious co-signer could therefore 'poison' the cache with a wrong amount and later prevent the owner from spending that coin. Second, single-signature segwit change outputs created by transactions the user signed were not being added to the cache, so an attacker could later trick the wallet into signing a spend that understated the change amount. The patch defers cache writes until after a signature is actually produced, and captures single-sig segwit change amounts at finalize time. It also expands the cache size from 30 to 128 entries.

This update fixes a bug in how the COLDCARD wallet reads PSBT files (the standard format for passing Bitcoin transactions between devices). Previously, if a PSBT contained the same special 'singleton' key twice in the same section, the device might silently use the second value. Now it immediately rejects the file. Duplicate singleton keys could let a malicious transaction tool trick the wallet into using one value while a human reviewer sees another, potentially causing the wrong amount or destination to be signed.

This commit fixes a security bug in the COLDCARD hardware wallet's 'Delta Mode' duress feature. Delta Mode is designed to make the device look normal while silently protecting secrets. Previously, a coercer could force someone to open the Trick PINs menu and either view the full seed words of a duress wallet, or activate that wallet, without triggering a wipe. This exposed the duress wallet's funds and weakened the user's deniability. The fix makes both actions trigger a secure wipe when in Delta Mode, matching how other secret-revealing flows already behaved. Browsing the menu still works so Delta Mode remains plausible.

This fix closes a gap where COLDCARD would approve and sign a Bitcoin transaction with an invalid version number if the transaction was packaged in the newer PSBTv2 format. For PSBTv0, such bad versions were already rejected, but the PSBTv2 code path skipped that check. The result could be a signed transaction that the Bitcoin network refuses to relay, potentially trapping funds or breaking wallet workflows. The patch adds the same version-number sanity check to the shared validation routine so both PSBT versions are protected.

This commit simplifies how the COLDCARD firmware tracks writes to its external PSRAM memory chip. Previously, the firmware kept two separate counters: one for transaction (TXN) data and one for firmware upgrade images. The change merges them into a single counter that increments on any PSRAM write. The goal is to make it harder for an attacker to silently modify data after the user has reviewed it, by detecting any later write to PSRAM. It is a defensive hardening change rather than a fix for a known active attack, and the commit message does not describe a specific vulnerability.

This update fixes a bug in COLDCARD's handling of BIP-322 Proof of Reserves (POR). A maliciously crafted proof could include a foreign (not owned by the device) Bitcoin input disguised to look like the device's own input using a fake key path and a partial signature. Before the fix, the device might have accepted such a foreign input in a POR, potentially allowing someone to falsely inflate or manipulate a proof of reserves. After the fix, the device rejects any POR that contains inputs it is not actually going to sign, beyond the required first input.

This commit only changes test scripts and test infrastructure for the COLDCARD firmware simulator. It adjusts timeouts, adds helper functions for waiting on screen text, fixes test flakiness, and tweaks how tests are split across parallel jobs. There are no changes to the actual firmware code that runs on the device, so this cannot affect real users or introduce a security vulnerability in the product itself.

This commit fixes a bug in COLDCARD's BIP-322 Proof of Reserves (POR) feature. POR lets a wallet prove it controls certain bitcoins without moving them. The bug allowed an attacker to include someone else's unspent coin in the proof by disguising it with fake key-path metadata and a bogus partial signature. The device would then treat that foreign input as already signed and belonging to the wallet, making the proof falsely claim control of funds the wallet does not actually own. The fix checks that the device can actually derive the required signing key for each input, rather than relying on attacker-controlled key-path data.

This commit only adds a new automated test for the COLDCARD hardware wallet. It checks that a backup file can be restored as a temporary seed while the device is in a 'seedless' state. There is no change to the actual wallet firmware code, only to the test suite, so it does not introduce or fix a security vulnerability by itself.

This commit adds safety checks to prevent the COLDCARD wallet from overwriting or restoring the main master secret while a temporary seed is active. Without these guards, a low-level restore or seed-setting operation could potentially replace the real wallet seed while the device is operating under a temporary seed, leading to confusion or loss of funds. The fix adds explicit assertions that block these operations when a temporary seed is in use.

This commit fixes a bug in the COLDCARD hardware wallet where two seed-management features (teleport and Seed XOR) did not properly recognize temporary/ephemeral wallets. Previously, the code only checked whether the secure element (SE) held a permanent seed. If a user was operating from a temporary seed while the SE was blank, the device treated the wallet as empty. In teleport, this could cause an incoming seed to overwrite the current temporary seed as the master seed. In Seed XOR, it could cause the reconstructed seed to be saved as the master seed or fail to warn that the result would be temporary. The fix makes both features check whether any secret—stored or temporary—is active.

This commit fixes a logic bug in how COLDCARD decides whether to restore a backup as a temporary wallet or as the device's main wallet. Previously, the code checked whether the master secret was blank using an older method. The fix changes that check to use a more accurate function that detects whether any secrets are active. The risk is that a backup could be restored to the wrong place—permanently overwriting the main wallet when the user expected a temporary restore, or failing to create a temporary wallet when one was intended. The commit message calls this a bugfix but does not describe it as a security issue.

This commit fixes a display layout problem on the COLDCARD Q hardware wallet. When showing 24 special 'TRNG words' on the Q's screen, the list was being split across two screens in a confusing way, so a user might not see all words together. The change adds a hint telling the user to scroll, and adjusts the text so the 24-word grid starts cleanly on a new screen. It is a usability fix for viewing sensitive seed material, not a fix for a code-execution or theft vulnerability.

This commit adds a new standalone Python helper script and its tests. The script lets a user independently verify how COLDCARD mixes its built-in random words with dice rolls or coin flips to create a seed. It does not change any firmware code, wallet behavior, or cryptographic logic in the device itself. There is no indication this is a security fix or that it addresses any vulnerability.

This update fixes a user-interface bug where the 'Change Main PIN' option remained visible while using a temporary wallet or a BIP-39 passphrase wallet. Changing the main PIN from a temporary wallet could confuse users or lead to unexpected wallet state, so the option is now hidden in those modes. It is a straightforward menu fix rather than a cryptographic flaw.

This update fixes a bug in the COLDCARD hardware wallet's handling of BIP-322 Proof of Reserves (PoR) transactions. Previously, the wallet could be presented with a PoR PSBT containing extra 'foreign' inputs that it did not control, and it would not clearly reject the transaction. This could allow a malicious or malformed PoR request to include unrelated inputs, potentially misleading the user or weakening the proof. The fix now rejects any BIP-322 PoR PSBT that contains inputs not belonging to the wallet.

This update fixes a security bug in the COLDCARD hardware wallet's firmware upgrade process. Previously, an attacker could potentially swap the staged firmware image while the user was still reviewing the upgrade approval screen. The device now uses a write counter to detect if the staged firmware image was overwritten after it was shown to the user, and aborts the upgrade if so. The change log credits Huzaifa Jawaid for the finding.

This commit fixes a bug in the COLDCARD HSM (High-Security Mode) where signing BIP-322 messages using private keys stored in the device's WIF Store could bypass the message-signing policy. Previously, such signatures may have been allowed even when the policy only permitted specific derivation paths. The fix now requires the HSM policy to explicitly allow 'any' path before WIF Store keys can be used for BIP-322 signing. This is a security-hardening bugfix for a niche but sensitive code path.

This commit fixes a security bug in the COLDCARD hardware wallet's firmware update process. Previously, while the user was looking at the approval screen for one firmware file, a second file could be silently uploaded and replace the first one. If the user approved, the second (unreviewed) firmware would be installed instead of the one they saw on screen. The fix records a fingerprint of the staged firmware at approval time and checks it again right before flashing, aborting if anything changed.

This commit fixes a bug in the COLDCARD hardware wallet's virtual disk (VirtDisk) feature. When a user imported a file via the virtual disk, the firmware's fast C importer copied data directly into a sensitive memory area used to stage pending Bitcoin transactions. Because it bypassed the normal tracking mechanism, the wallet did not realize the transaction data had been touched. An attacker or malicious program with virtual disk access could therefore overwrite a transaction you were about to approve, and the wallet might sign the altered version instead of the one you reviewed on screen. The fix records the write, revokes any pending download lease, and adds a test proving the wallet now aborts signing when this happens.