bugfix: invalidate message signatures in Delta Mode
What the developer wrote
Authored by scgbckbone
bugfix: invalidate message signatures in Delta Mode
What changed, and why it matters
This update fixes a bug in the COLDCARD hardware wallet where signing a text message with the special 'Delta Mode' PIN would produce a signature that looked valid to anyone checking it. Delta Mode is a hidden feature that silently corrupts transaction signatures so attackers who force you to unlock your wallet cannot steal funds. The same protection was missing for message signatures, so an attacker could have tricked a victim into producing a seemingly valid signed message under duress. The fix makes message signatures produced in Delta Mode invalid, matching the existing behavior for transactions.
Treat as a security bugfix worth including in release notes. Users relying on Delta Mode should ensure firmware is updated so that message signatures cannot be coerced under duress. No immediate incident response is indicated by the commit alone.
Security signals we found
Delta Mode is a duress/deceptive PIN feature that intentionally produces invalid cryptographic outputs
Message signatures produced under Delta Mode were previously verifiable, unlike transaction signatures
Fix silently invalidates signatures by hashing the digest a second time, making verification fail
No CVE, advisory, or researcher attribution present in commit or supplied references
Evidence from the diff
In shared/msgsign.py, the sign_message_digest() function now checks sv.deltamode and, if active, replaces the digest with SHA256d(digest) before signing. Because the signature is computed over a different digest than the verifier expects, the resulting signature will fail verification. This mirrors the existing Delta Mode behavior for transaction signing. The change is a 5-line addition plus a changelog entry.
Changed components
shared/msgsign.pyCOLDCARD message signing featureDelta Mode PIN behaviorInspect captured patch +6 / −0
### releases/Next-ChangeLog.md
@@ -14,6 +14,7 @@ This lists the new changes that have not yet been published in a normal release.
- Change: Block `SIGHASH_SINGLE` and `SIGHASH_SINGLE|ANYONECANPAY` by default because they can leave later transaction outputs modifiable after signing. They remain available when Sighash Checks is set to Warn.
Thanks to [@instagibbs](https://github.com/instagibbs) for reporting this issue.
- Bugfix: Fixed PSBT uploads being mistaken for partial firmware uploads.
+- Bugfix: Prevent valid message signatures when using a Delta Mode PIN.
# Mk Specific Changes
### shared/msgsign.py
@@ -384,6 +384,11 @@ def sign_message_digest(digest, subpath, prompt, addr_fmt=AF_CLASSIC, pk=None):
dis.progress_sofar(50, 100)
pk = node.privkey()
addr = ch.address(node, addr_fmt)
+
+ if sv.deltamode:
+ # Silently invalidate signatures made under the Delta PIN,
+ # matching transaction-signing behavior.
+ digest = ngu.hash.sha256d(digest)
else:
# if private key is provided, derivation subpath is ignored
# and given private key is used for signing.Why this scored 65/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.