CommitWatch RSS
CK
← All projectsCoinkite

COLDCARD firmware

Open-source firmware for COLDCARD Bitcoin signing devices.

BitcoinHardware walletsActive incident
Source repository ↗
Repository coverage

468 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

137security candidates209second-pass queue413AI analyses
56commits · 30 days
184commits · 60 days
253commits · 180 days
385commits · 365 days
Backfill bands
Aug 5 → Feb 6148 seen2 candidatesComplete
Feb 6 → Jun 684 seen8 candidatesComplete
Jun 6 → Jul 649 seen4 candidatesComplete
Jul 6 → Aug 525 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

36/100 average clarity
10Strong · 80–100
45Adequate · 60–79
195Thin · 40–59
218Opaque · 0–39
42security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
scgbckbone2551112271643
Peter D. Gray17020162818
Dmitry Monakhov212173
@Bibo-dochex923042
kdmukai111050
doc-hex111073
Piotr Duszynski111073
tadeubas606051
copilot-swe-agent[bot]504072
Danilo500079
hitechhayekian301081
Copilot300074
Analysis record

Published AI watches

Last scanned 52 minutes ago

Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 91 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add regression test for non-object JSON message-sign input

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list)…

Regression test for input validation of JSON message-signingTest comment explicitly references avoiding a device crash on malformed JSON inputTest requested during review of pull request #808, suggesting prior related code change
adb7baa8by copilot-swe-agent[bot]+32−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

hygiene: duress wallet activate - wipe before getting slot data

This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in …

secret-handling order-of-operations changeDelta Mode coercer/wipe scenarioduress wallet secret loading
aa645247by scgbckbone+3−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

OVC clear stale outputs from new_outputs

This firmware update fixes a cleanup issue in the COLDCARD wallet's transaction signing code. Before finalizing a new Bitcoin transaction, the device now clears out leftover 'change output' records that may have been captured during a prev…

State not reset between signing attemptsStale change-output metadata reused in transaction finalizationOVC (Output Value Check) validation may be affected by leftover data
62163ccdby scgbckbone+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Drop ValueError message string to save flash space

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still…

dc89513cby copilot-swe-agent[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add changelog entry for msgsign JSON crash fix

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). …

Device crash on malformed message-signing inputInput vector includes NFC, QR, and SD card JSON filesValid JSON but wrong type (non-object) bypasses simple format checks
07afee0dby copilot-swe-agent[bot]+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix uncaught AttributeError on non-object JSON in parse_msg_sign_request

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix ch…

uncaught exception in message parsing pathinput validation gap on JSON typepotential denial-of-service via malformed request
d55ddbceby copilot-swe-agent[bot]+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for mk release.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes,…

e6d01c36by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for q1 release.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, an…

a310e1ddby Peter D. Gray+16−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

3caf599eby Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new policy w blank lines

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code …

3d8f90f1by Peter D. Gray+9−561 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update for new release

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q,…

USB protocol encryption upgrade (ncry v3) with direction-separated keys and replay protectionPSBT tampering detection: re-verify staged bytes before signing after Virtual Disk overwriteFirmware update integrity: abort if staged image overwritten, reject images extending past world-checksum region
ea2b89bfby Peter D. Gray+272−1124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

15deb2f6by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: report staged firmware modification at upgrade approval

This commit fixes a bug in the COLDCARD firmware upgrade process. Previously, if someone tampered with the staged firmware after the user saw the approval prompt but before they confirmed, the device would crash with a bare internal error …

Tamper-detection failure path hardened: assert replaced with user-facing failure storyDefense-in-depth assertion added to PIN-changing flowTest coverage added for tamper-abort message
ef73cf58by scgbckbone+6−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bump ckcc to latest master

This commit only updates a linked external code library (a Git submodule called ckcc-protocol) to a newer version. The actual code changes inside that library are not shown in the commit diff, and no security-related information was provid…

ec1c9417by scgbckbone+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

tweaks

This commit only edits the draft release changelog file. It rewords two upcoming feature descriptions and fixes line wrapping for another entry. No source code, firmware logic, or security behavior was changed.

e166ffddby Peter D. Gray+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: reject non-ASCII BIP-39 passphrases

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters diff…

Behavioral fix that prevents silent derivation of incompatible wallet seedsInput validation added for BIP-39 passphrase across USB, UI, saved-passphrase restore, and note/password lanesRejection of non-printable ASCII and non-ASCII Unicode characters
c1a67660by scgbckbone+155−147 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 74 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: capture single-sig segwit change

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a tr…

Fixes deferred persistence of UTXO amount cache until after successful signingFixes missing capture of single-sig segwit change outputs (p2wpkh and p2sh-p2wpkh)Prevents cache poisoning by cancelled/malicious PSBT previews
8979a8a5by scgbckbone+322−806 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Reject duplicate singleton PSBT keys

This update fixes a bug in how the COLDCARD wallet reads PSBT files (the standard format for passing Bitcoin transactions between devices). Previously, if a PSBT contained the same special 'singleton' key twice in the same section, the dev…

PSBT parser now rejects duplicate singleton keysNew test cases for duplicate keys in global/input/output mapsChangelog labels the change as a bugfix
cb6df8daby scgbckbone+30−13 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedreword last_fail_reasonby Peter D. Gray · 335df666 · Sep 16, 2025 · 1 fileMessage 18 · OpaqueLow 38Details
Commit message · Peter D. Gray

reword last_fail_reason

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 38/100

This commit reworks how the COLDCARD wallet records why a spending policy was rejected. Previously the reason was stored only in memory, so it disappeared when the device was powered off. Now it is saved to device settings, letting the owner view the reason after restarting. The change also fixes a few related bugs, such as a menu accidentally showing the wrong policy and missing parentheses on some 'is enabled' checks. There is no direct evidence in the commit that this fixes an active security vulnerability, but it improves reliability and auditability of policy enforcement.

AI review queuedmoreby Peter D. Gray · a4c7f95d · Sep 16, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

more

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds a one-line note to a test file describing a future test case. No actual code, fix, or behavior change is present in the diff.

AI review queuedmroe docsby Peter D. Gray · dbb2a217 · Sep 16, 2025 · 2 filesMessage 0 · OpaqueInformational 15Details
Commit message · Peter D. Gray

mroe docs

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit only updates user documentation for two COLDCARD features: Spending Policy and Web 2FA. It adds explanatory text, reorganizes sections, and fixes typos. No source code, firmware logic, or security behavior was changed.

AI review queuedslightly better SE2 emulationby Peter D. Gray · b8435fdd · Sep 16, 2025 · 2 filesMessage 35 · OpaqueInformational 19Details
Commit message · Peter D. Gray

slightly better SE2 emulation

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 19/100

This commit improves the Unix simulator's fake version of the COLDCARD's second secure element (SE2). It fixes a small bug where logging in with a 'trick PIN' could leave the wrong wallet loaded when later doing a normal login, and it makes the simulator better at rebuilding trick-PIN state from saved settings. These changes only affect the software simulator used for development/testing, not real COLDCARD hardware.

AI review queuedfix0by scgbckbone · 6abb2444 · Sep 16, 2025 · 2 filesMessage 0 · OpaqueLow 35Details
Commit message · scgbckbone

fix0

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 35/100

This commit fixes a UI label mix-up in the COLDCARD's 'SSSP' (Seed Safe Spending Policy) menu. Two settings were swapped: the menu item called 'Word Check' was actually controlling access to secure notes, while 'Allow Notes' was actually controlling the seed-word challenge. The fix swaps their labels and underlying setting keys so each toggle controls the feature its name describes. There is no direct evidence this is a security vulnerability, but mislabeled security controls can mislead users and cause unintended access grants.

AI review queuedimprovementsby Peter D. Gray · d9a601e8 · Sep 16, 2025 · 5 filesMessage 18 · OpaqueLow 49Details
Commit message · Peter D. Gray

improvements

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Low 49/100

This commit makes several small changes to the COLDCARD firmware. It removes a debug print statement that exposed internal warnings, blocks certain key-teleport QR codes when the device is in a restricted 'hobbled' mode, and removes a 'has_secrets' safety check from wallet export menu items in hobbled mode. The changes appear to be hardening and UI consistency fixes rather than a clear security patch, but one change weakens an access-control predicate while others strengthen restrictions.

AI review queuedslip32 --> slip132by scgbckbone · f89061ff · Sep 4, 2025 · 5 filesMessage 18 · OpaqueInformational 15Details
Commit message · scgbckbone

slip32 --> slip132

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a simple cleanup rename from 'SLIP-32' to 'SLIP-132' plus a typo fix. SLIP-32 was a mistaken label; the actual Bitcoin standard for versioned extended keys is SLIP-132. No behavior changed, and no security issue is present.

AI review queuednarrowerby nvk · 56e5b984 · Aug 18, 2025 · 1 fileMessage 0 · OpaqueInformational 15Details
Commit message · nvk

narrower

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Informational 15/100

This commit changes a small monochrome arrow/checkmark graphic in the COLDCARD firmware. The old shape was a narrow pointer; the new shape is a slightly different narrow pointer using different ASCII characters. There is no code change, no security behavior change, and no indication this fixes or introduces a vulnerability.

AI review queuedfix HSM UX message textby scgbckbone · 123caec8 · Aug 13, 2025 · 2 filesMessage 38 · OpaqueInformational 15Details
Commit message · scgbckbone

fix HSM UX message text

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit fixes a typo in a user-facing message shown by the COLDCARD's HSM (Hardware Security Module) policy screen. The phrase 'Address values values will be shared' is corrected to 'Address values will be shared'. There is no security impact.