fix: file picker in import BIP-322 msg needs vdisk and slot_b args
What the developer wrote
Authored by scgbckbone
fix: file picker in import BIP-322 msg needs vdisk and slot_b args
What changed, and why it matters
This is a small bug fix in the COLDCARD hardware wallet firmware. When importing a BIP-322 message from a file, the file picker was not being told which storage source to use (virtual disk or SD card slot). This could cause the file picker to look in the wrong place or fail to find files, making the feature unreliable rather than directly stealing funds.
Treat as a routine bug fix. Verify that file_picker correctly handles vdisk and slot_b and that no additional paths are exposed. No urgent security response is indicated by the diff alone.
Security signals we found
Missing arguments to a file picker could lead to wrong-storage selection or user confusion
No direct evidence of memory corruption, injection, or cryptographic weakness in the diff
Evidence from the diff
In shared/auth.py, the BIP-322 message import flow calls file_picker() twice without passing the storage-selection arguments (vdisk and slot_b) that are contained in the ch kwargs. The patch adds **ch to both calls so the picker respects the user’s chosen storage location. This is a functional bug fix; there is no direct evidence in the diff of a security vulnerability such as path traversal, arbitrary file read, or authentication bypass.
Changed components
shared/auth.pyBIP-322 message import file pickerCOLDCARD firmware UX flowInspect captured patch +2 / −2
diff --git a/shared/auth.py b/shared/auth.py
index 7f998d3..378f9d8 100644
--- a/shared/auth.py
+++ b/shared/auth.py
@@ -315,7 +315,7 @@ class ApproveTransaction(UserAuthorizedAction):
from ux_q1 import QRScannerInteraction
msg = await QRScannerInteraction().scan_text('Scan message from a QR code')
else:
- choices = await file_picker(suffix='.txt', ux=False)
+ choices = await file_picker(suffix='.txt', ux=False, **ch)
target = "%s.txt" % b2a_hex(self.psbt.por322_msg_hash).decode()
for fname, dir, _ in choices:
@@ -323,7 +323,7 @@ class ApproveTransaction(UserAuthorizedAction):
fn = dir + "/" + fname
break
else:
- fn = await file_picker(choices=choices)
+ fn = await file_picker(choices=choices, **ch)
if not fn: return
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.