What the developer wrote
Authored by benma
optiga: handle counter reset errors
Check the return value of _reset_counter() in
_configure_object_counter() and propagate failures before
writing metadata.
This restores the previous behavior where counter initialization
errors abort setup instead of being silently ignored.
What changed, and why it matters
This commit fixes a bug in the BitBox02 hardware wallet's handling of a tamper-resistant counter chip (Optiga). Previously, if the counter reset failed, the device silently ignored the error and continued to write metadata. Now the error is checked and the setup is aborted. This restores safer behavior and prevents the device from continuing in a potentially inconsistent state.
Review whether any released firmware shipped with the silent-ignore behavior and assess if a monotonic-counter failure could weaken anti-rollback or security-bound protections. No immediate user action is indicated.
Security signals we found
Unchecked return value from security-critical hardware operation
Silent failure in tamper-resistant monotonic counter setup
Potential inconsistent secure-element state if metadata write proceeds after reset failure
Fix restores prior abort-on-error behavior
Evidence from the diff
In src/optiga/optiga.c, _configure_object_counter() previously discarded the return value of _reset_counter(). The patch captures the result and returns early on failure, preventing optiga_ops_util_write_metadata_sync() from being called after a failed counter reset. This is a defensive correctness fix in the secure-element counter initialization path.
Changed components
src/optiga/optiga.cOptiga secure element counter initializationBitBox02 firmware setup/reset flowInspect captured patch +4 / −1
diff --git a/src/optiga/optiga.c b/src/optiga/optiga.c
index b1751c1..883e99b 100644
--- a/src/optiga/optiga.c
+++ b/src/optiga/optiga.c
@@ -785,7 +785,10 @@ static int _configure_object_counter(void)
}
util_log("_configure_object_counter: setting up");
- _reset_counter(oid, MONOTONIC_COUNTER_MAX_USE);
+ res = _reset_counter(oid, MONOTONIC_COUNTER_MAX_USE);
+ if (res != OPTIGA_LIB_SUCCESS) {
+ return res;
+ }
return optiga_ops_util_write_metadata_sync(
_util, oid, _counter_metadata, sizeof(_counter_metadata));
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.