CommitWatch RSS
CK
← Watched projectsVendor accountability

Coinkite

Maker of the open-source COLDCARD Bitcoin signing device.

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 91 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add regression test for non-object JSON message-sign input

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list)…

Regression test for input validation of JSON message-signingTest comment explicitly references avoiding a device crash on malformed JSON inputTest requested during review of pull request #808, suggesting prior related code change
adb7baa8by copilot-swe-agent[bot]+32−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

hygiene: duress wallet activate - wipe before getting slot data

This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in …

secret-handling order-of-operations changeDelta Mode coercer/wipe scenarioduress wallet secret loading
aa645247by scgbckbone+3−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

OVC clear stale outputs from new_outputs

This firmware update fixes a cleanup issue in the COLDCARD wallet's transaction signing code. Before finalizing a new Bitcoin transaction, the device now clears out leftover 'change output' records that may have been captured during a prev…

State not reset between signing attemptsStale change-output metadata reused in transaction finalizationOVC (Output Value Check) validation may be affected by leftover data
62163ccdby scgbckbone+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Drop ValueError message string to save flash space

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still…

dc89513cby copilot-swe-agent[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add changelog entry for msgsign JSON crash fix

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). …

Device crash on malformed message-signing inputInput vector includes NFC, QR, and SD card JSON filesValid JSON but wrong type (non-object) bypasses simple format checks
07afee0dby copilot-swe-agent[bot]+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix uncaught AttributeError on non-object JSON in parse_msg_sign_request

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix ch…

uncaught exception in message parsing pathinput validation gap on JSON typepotential denial-of-service via malformed request
d55ddbceby copilot-swe-agent[bot]+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for mk release.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes,…

e6d01c36by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for q1 release.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, an…

a310e1ddby Peter D. Gray+16−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

3caf599eby Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new policy w blank lines

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code …

3d8f90f1by Peter D. Gray+9−561 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update for new release

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q,…

USB protocol encryption upgrade (ncry v3) with direction-separated keys and replay protectionPSBT tampering detection: re-verify staged bytes before signing after Virtual Disk overwriteFirmware update integrity: abort if staged image overwritten, reject images extending past world-checksum region
ea2b89bfby Peter D. Gray+272−1124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

15deb2f6by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: report staged firmware modification at upgrade approval

This commit fixes a bug in the COLDCARD firmware upgrade process. Previously, if someone tampered with the staged firmware after the user saw the approval prompt but before they confirmed, the device would crash with a bare internal error …

Tamper-detection failure path hardened: assert replaced with user-facing failure storyDefense-in-depth assertion added to PIN-changing flowTest coverage added for tamper-abort message
ef73cf58by scgbckbone+6−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bump ckcc to latest master

This commit only updates a linked external code library (a Git submodule called ckcc-protocol) to a newer version. The actual code changes inside that library are not shown in the commit diff, and no security-related information was provid…

ec1c9417by scgbckbone+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

tweaks

This commit only edits the draft release changelog file. It rewords two upcoming feature descriptions and fixes line wrapping for another entry. No source code, firmware logic, or security behavior was changed.

e166ffddby Peter D. Gray+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: reject non-ASCII BIP-39 passphrases

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters diff…

Behavioral fix that prevents silent derivation of incompatible wallet seedsInput validation added for BIP-39 passphrase across USB, UI, saved-passphrase restore, and note/password lanesRejection of non-printable ASCII and non-ASCII Unicode characters
c1a67660by scgbckbone+155−147 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 74 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: capture single-sig segwit change

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a tr…

Fixes deferred persistence of UTXO amount cache until after successful signingFixes missing capture of single-sig segwit change outputs (p2wpkh and p2sh-p2wpkh)Prevents cache poisoning by cancelled/malicious PSBT previews
8979a8a5by scgbckbone+322−806 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Reject duplicate singleton PSBT keys

This update fixes a bug in how the COLDCARD wallet reads PSBT files (the standard format for passing Bitcoin transactions between devices). Previously, if a PSBT contained the same special 'singleton' key twice in the same section, the dev…

PSBT parser now rejects duplicate singleton keysNew test cases for duplicate keys in global/input/output mapsChangelog labels the change as a bugfix
cb6df8daby scgbckbone+30−13 files
No security note in commit
Open full analysis →Source commit ↗