do not repeat HSM_DISABLE_CMDS in HOBBLED_CMDS
What the developer wrote
Authored by scgbckbone
do not repeat HSM_DISABLE_CMDS in HOBBLED_CMDS
What changed, and why it matters
This commit is a small code cleanup in the COLDCARD firmware's USB command handling. It removes a manually duplicated list of commands that were already defined elsewhere (HSM_DISABLE_CMDS) and instead reuses that existing list. There is no direct evidence this fixes an active security bug, but it reduces the risk of future mistakes where the two lists become inconsistent and a restricted command accidentally stays allowed.
Treat as a low-risk maintainability patch. Review whether HSM_DISABLE_CMDS and HOBBLED_CMDS are intended to be identical or whether HOBBLED_CMDS should be a strict superset, and verify no command was unintentionally added or removed by the union. No urgent action required.
Security signals we found
Command-list deduplication in security-relevant USB policy code
Change touches HSM (Hardware Security Module / HSM policy) command restrictions
Potential for future inconsistency between HOBBLED_CMDS and HSM_DISABLE_CMDS is reduced
Evidence from the diff
In shared/usb.py, the HOBBLED_CMDS frozenset previously repeated several command codes (‘user’, ‘rmur’, ‘nwur’, ‘gslr’, ‘hsts’, ‘hsms’) that were already members of HSM_DISABLE_CMDS. The patch deletes the duplicate entries and replaces them with a set union (| HSM_DISABLE_CMDS). This is a maintenance/refactoring change that ensures HOBBLED_CMDS always stays synchronized with HSM_DISABLE_CMDS. The diff shows no functional change to the resulting command set unless those two lists had already diverged in the codebase, which the commit does not claim.
Changed components
shared/usb.pyUSB command filtering / HSM policy enforcementInspect captured patch +1 / −8
diff --git a/shared/usb.py b/shared/usb.py
index c1b15c2..587ad68 100644
--- a/shared/usb.py
+++ b/shared/usb.py
@@ -75,14 +75,7 @@ HOBBLED_CMDS = frozenset({
'enrl', # no new multisigs during policy enforcement
'back', # no backups
'bagi', 'dfu_', # just in case
-
- "user", # same as HSM_DISABLE_CMDS
- "rmur",
- "nwur",
- "gslr",
- "hsts",
- "hsms",
-})
+}) | HSM_DISABLE_CMDS
# singleton instance of USBHandler()
handler = None
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.