COLDCARD firmware

This commit adds a new menu option that lets users see the 24 secret words representing the device's random seed before any user-provided dice rolls or coin flips are mixed in. It is a transparency/verification feature, not a security fix. The change log explicitly calls it a bugfix for a previously removed ability to view the device-generated seed, and the code adds warnings that these words must be kept secret.

This commit only changes test scripts for the COLDCARD hardware wallet firmware. It adds small timing delays, adjusts the order of test assertions, and fills in missing steps in automated UI tests. There are no changes to the actual firmware or wallet code that users rely on, so this cannot affect real device security.

This commit only rewords an on-screen user warning about keeping dice-roll hashes secret. It does not change any code behavior, cryptography, or security logic. The change makes the warning more precise: it clarifies that seeing any intermediate hash (not just the final one) could let someone recreate the wallet from the dice rolls entered up to that point. There is no vulnerability or security fix here.

This commit adds a new, more secure USB encryption mode (ncry v3) to the COLDCARD hardware wallet firmware. It does not remove the older v1/v2 mode. The new mode adds message authentication tags and separate keys for each direction, which protects against tampering, replay, and reflection attacks on the USB cable. The commit also fixes a timing side-channel in user authentication by replacing direct HMAC comparisons with a constant-time comparison. The change is defensive and improves security, but the old unauthenticated modes remain available for compatibility, so users must actively choose v3 to get the stronger protection.

This commit fixes a bug in the COLDCARD firmware update process. Previously, the maximum file size allowed for a firmware update file (.dfu) was set too small because it was based on the firmware's own size limit, not accounting for extra data that comes with 'factory' update images (which include a bootloader and a DFU wrapper). As a result, legitimate factory firmware files could not be selected from the MicroSD card picker. The fix separates the two limits: one for the actual firmware size, and a larger one for the .dfu container shown in the file picker. There is no direct evidence in the commit that this was a security vulnerability, but overly restrictive size checks can sometimes hide or complicate downgrade or supply-chain issues.

This change makes the COLDCARD wallet require the user to scroll down before showing a BIP-39 passphrase on screen. The goal is to reduce the chance that someone nearby (a shoulder-surfer) or a camera can read the secret passphrase when it appears automatically. It is a small user-interface hardening improvement, not a fix for a remote hack.

This commit changes how the COLDCARD hardware wallet generates random numbers used to protect backups, encrypted files, and two-factor authentication secrets. Previously these sensitive values were produced using only the STM32 chip's built-in random number generator (TRNG). Now they are produced through a stronger combined method: a Hash-DRBG (a NIST-style deterministic random-bit generator) that is seeded from both secure elements and the TRNG. The change is defensive hardening rather than a fix for a known exploitable bug, but it reduces the risk that a weakness in the STM32 TRNG alone could weaken user secrets.

This commit tightens security for temporary Bitcoin wallet seeds created by rolling dice on a COLDCARD hardware wallet. Previously, temporary dice-generated seeds skipped the same mandatory entropy checks and warnings used for permanent dice-generated seeds. The change makes temporary dice seeds follow the same rules, so users cannot accidentally create a weak wallet from too few dice rolls. This is a defensive hardening fix, not an active bug that steals funds, but weak entropy could let an attacker guess a wallet's private keys.

This update fixes a bug in the COLDCARD MK4 hardware wallet where sensitive temporary data stored in extra memory (PSRAM) was not fully erased when the device performed a 'fast wipe' or self-destruct sequence. After wiping the seed, leftover application data could remain in that memory through a reset, potentially allowing someone with physical access to recover secrets. The patch now explicitly clears that memory during both wipe paths.

This update fixes a bug where the COLDCARD Q1 wallet could accidentally let a previously authorized USB file download remain valid while it reused a special memory area (PSRAM) to prepare new data for display or signing. If a backup download lease was still active, an attacker or malicious host connected over USB might have been able to read sensitive material that was later loaded into that same memory area. The patch now clears the download lease before staging PSBT files, BBQr data, or note exports in PSRAM.

This commit fixes a security bug in the COLDCARD hardware wallet where sensitive BIP39 seed-derivation data was not being securely erased from memory after use. The patch wraps the master-secret generation in a try/finally block and uses blank_object() to wipe the mnemonic words and derived master secret even if an error occurs. Without this fix, an attacker who could read the device's RAM might recover these secrets, though such access is normally difficult on a hardened hardware wallet.

This commit fixes a small but meaningful bug in the COLDCARD bootloader. Two separate code paths that check firmware update data were missing the word 'else', so after rejecting bad data they would also run a second check. That second check could trigger an internal assertion (a hard crash/reboot) when given an invalid 'highwater' timestamp value, instead of cleanly rejecting the bad update. The fix makes the bootloader properly reject invalid values without crashing.

This commit fixes a bug in the COLDCARD hardware wallet where using the BIP-85 feature while in Delta Mode could expose or operate on the real master seed instead of the expected temporary/delta seed. The fix forces the wallet to wipe the seed before performing BIP-85 derivation in Delta Mode, matching how other sensitive operations are already blocked. This is a security bugfix for a local, post-authentication edge case.

This commit fixes two ways a Coldcard in 'Delta Mode' (a restricted mode that hides the wallet seed) could still let a user pick or import secret seed phrases. One path was through 'Key Teleport' secret selection, and another was through importing a 'CCC key C' from the Seed Vault. The patch blocks both so Delta Mode cannot be bypassed to reveal or use stored secrets.

This commit fixes a bug in the COLDCARD hardware wallet where a transaction could be signed over USB even if the data shown on the device screen did not match the data actually being signed. Before the fix, an attacker or buggy software could upload one PSBT (a Bitcoin transaction file) but then ask the device to sign a different one, or sign data that was not fully/correctly uploaded. The fix makes the USB signing command strictly verify the staged PSBT's length and SHA-256 hash against what is stored in memory, and resets upload state on errors so stale data cannot be reused.

This commit fixes a bug in the COLDCARD hardware wallet's staged PSBT (Partially Signed Bitcoin Transaction) signing process. Previously, the wallet only re-checked the transaction hash if something was written to the lower 'input' staging region of its external memory. Writes to the upper 'output' staging region did not trigger a re-check, meaning a malicious or buggy process could potentially modify transaction data there without detection. The fix makes the write counter cover both regions, ensures oversized transaction files are rejected before staging, and updates the signing guard so that a write to the inactive region is treated as a new baseline rather than a false alarm. In short, it closes a gap where a transaction could be tampered with after user review but before signing.

This commit changes which physical buttons on the COLDCARD device are treated as 'done' or 'cancel' keys during a dice-roll seed-generation feature. It makes the choice depend on the device model (QWERTY keyboard vs. non-QWERTY) instead of hardcoding a mix of keys. The change is small and appears to be a UI/UX correctness fix rather than a security vulnerability. There is no clear evidence in the commit that this fixes an exploitable bug.

This commit adds a startup safety check for the hardware random-number generator (RNG) in the COLDCARD MK4 firmware. Before anything else can use randomness, the device now verifies that the rng_get() function actually reaches the hardware RNG and returns real entropy. If the check fails, the device deliberately halts ('bricks' itself) rather than boot. The change is defensive: it does not fix a known exploit, but it is designed to prevent a future bug or supply-chain issue where the firmware might accidentally use a non-hardware (and therefore weaker) source of randomness.

This update fixes a bug in the COLDCARD hardware wallet where a security mode called 'Delta Mode' could still access the Seed Vault through a feature called Seed XOR restore. Delta Mode is meant to restrict what an attacker or unauthorized user can do with the device. The fix blocks that access path. The bug was reported by someone named Rety.

This update fixes a bug in the COLDCARD hardware wallet's USB download command. Previously, a connected computer could ask the COLDCARD to read back almost anything it had temporarily stored in its extra memory chip (PSRAM), including uploaded transaction files or multisig setup files, even across different USB sessions and without encryption. Now the device only allows downloading the single most recent result it explicitly produced for the user (such as a signed transaction or backup), only over an encrypted session, and only until a new upload or session resets the permission.

This commit fixes a security bug where a malicious or compromised computer connected to a COLDCARD wallet could potentially swap the transaction data after the user reviewed it on the device screen but before the device signed it. The user might approve one transaction while the device signs a different one. The fix locks down the staged transaction data, re-checks it right before signing, and aborts with an error if anything changed.

This fix corrects a user-interface bug in COLDCARD's dice-roll seed-generation feature. Previously, if a user held down a digit key, the device treated the auto-repeating key events as multiple separate dice rolls, rapidly adding many unintended rolls. After the fix, a held key registers exactly one roll when released, matching how number entry already works elsewhere. This reduces the chance a user accidentally skews their random seed by holding a button too long.

This commit only removes an obsolete test from the test suite. The deleted test was for a duress PIN feature on the older Mk3 Coldcard and used a 'fetch' parameter that no longer exists. There is no change to firmware code that users run, so it cannot introduce a security vulnerability or fix one.

This commit only adds a single line to the changelog, describing a bugfix that was apparently already made elsewhere. The bug concerned how COLDCARD's 'View Seed Words' and backup features handled BIP-39 passphrase wallets when a passphrase was applied on top of a temporary seed. In that case, the device reportedly treated the master seed as the parent instead of the immediate temporary seed, potentially showing or backing up the wrong secret. Because the actual code change is not in this commit, we cannot directly verify the fix or assess its full security implications from this diff alone.

This commit changes how COLDCARD backup, clone, and Key Teleport features handle temporary seeds and BIP-39 passphrases. Previously, users could sometimes back up the main wallet even when a passphrase or temporary seed was active. Now the device always backs up the wallet currently in effect and warns the user first. This is a security-hardening change that reduces the risk of accidentally exposing or archiving the wrong secret, but it is not a fix for an active remote exploit.