bugfix: wipe in deltamode before listing saved passphrases
What the developer wrote
Authored by scgbckbone
bugfix: wipe in deltamode before listing saved passphrases
What changed, and why it matters
This commit fixes a bug in the COLDCARD hardware wallet where, when the device is in 'Delta Mode' (a special temporary operating mode), opening the list of saved BIP-39 passphrases would reveal the passphrases and wallet fingerprints instead of securely wiping the seed first. The fix adds a call to wipe the seed if Delta Mode is active before displaying the saved passphrase menu. This prevents sensitive secret material from being exposed on screen in a mode meant to limit what an attacker can see.
Treat this as a security fix and include it in the next firmware release. Review other menu constructors and sensitive-data display paths for similar missing wipe_if_deltamode() calls, especially any that decrypt or show seed-derived data. Consider adding automated tests or linting to enforce Delta Mode wipes before UI presentation of secrets.
Security signals we found
Information disclosure of saved BIP-39 passphrases and XFPs in Delta Mode
Missing seed wipe before handling sensitive data in a restricted operating mode
Delta Mode bypass/privacy leak in passphrase management UI
Patch adds explicit defensive wipe call before menu construction
Evidence from the diff
In shared/pwsave.py, the PassphraseSaver.construct() method builds a menu of saved passphrase entries. Previously, when invoked in Delta Mode, it would decrypt and display each saved passphrase’s text and XFP (wallet fingerprint) without first clearing sensitive state. The patch imports wipe_if_deltamode from utils and calls it before constructing the menu, ensuring the seed is wiped in Delta Mode before any saved passphrase data can be revealed. The changelog describes this as ‘Wipe seed in Delta Mode when saved BIP-39 passphrases are listed, instead of revealing them.’
Changed components
shared/pwsave.pyPassphraseSaver.construct()Delta Mode seed/passphrase handlingSaved BIP-39 passphrase menu UIInspect captured patch +5 / −1
### releases/Next-ChangeLog.md
@@ -7,6 +7,7 @@ This lists the new changes that have not yet been published in a normal release.
- Bugfix: Detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults.
- Bugfix: Prevent access to Seed Vault entries through Seed XOR restore in Delta Mode. Thanks to
Rety for reporting this.
+- Bugfix: Wipe seed in Delta Mode when saved BIP-39 passphrases are listed, instead of revealing them.
# Mk Specific Changes
### shared/pwsave.py
@@ -5,7 +5,7 @@
import stash, ujson, ngu, pyb, os, version, aes256ctr
from files import CardSlot, CardMissingError, needs_microsd
from ux import ux_dramatic_pause, ux_confirm, ux_show_story, OK, X
-from utils import xfp2str, problem_file_line, B2A
+from utils import xfp2str, problem_file_line, B2A, wipe_if_deltamode
from menu import MenuItem, MenuSystem
from glob import settings
@@ -192,6 +192,9 @@ def construct(cls):
# We have a list of xfp+pw fields. Make a menu.
# Read file, decrypt and make a menu to show; OR return None
# if any error hit.
+ # - menu leaks passphrase text and XFP of each hidden wallet
+ wipe_if_deltamode()
+
pw_saver = PassphraseSaver()
with CardSlot() as card:
pw_saver._calc_key(card)Why this scored 71/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.