What the developer wrote
Authored by scgbckbone
Confirm cloned seed fingerprint
What changed, and why it matters
This update changes the Coldcard wallet cloning process so that the receiving device now displays the restored seed's master fingerprint and asks the user to confirm it before installing. Previously, the clone process skipped this confirmation step. The change helps prevent a user from accidentally accepting a different seed than intended during a clone, which could lead to backing up or using the wrong wallet.
Treat as a minor hardening improvement. No immediate incident response needed, but users should ensure they verify the master fingerprint when cloning devices.
Security signals we found
User confirmation added for restored seed fingerprint during clone
Previous clone path bypassed UX confirmation for restored seed
Risk of wrong seed being silently installed during physical clone process
Evidence from the diff
In shared/backups.py, the clone restore path removed the ux_confirm=False argument to restore_complete_doit(), causing the receiving Coldcard to prompt the user to confirm the restored seed’s master fingerprint (XFP) before installation. The changelog describes this as an enhancement. The test was updated to expect one additional ENTER keypress for the new confirmation screen.
Changed components
shared/backups.pyColdcard clone/restore featureuser confirmation flow during seed restorationInspect captured patch +6 / −6
### releases/Next-ChangeLog.md
@@ -61,6 +61,8 @@ This lists the new changes that have not yet been published in a normal release.
during multisig wallet enrollment. Thanks to drk1wi for reporting this.
- Bugfix: Separate the SE1 check nonce from the PIN digest. Thanks to
[@instagibbs](https://github.com/instagibbs) for reporting this issue.
+- Enhancement: Clone Coldcard now shows the restored seed's master fingerprint on the receiving
+ Coldcard and asks for confirmation before installing it.
# Mk Specific Changes
### shared/backups.py
@@ -792,9 +792,7 @@ def delme(xfn):
uos.remove(fname) # ccbk-start.json
# this will reset in successful case, no return (but delme is called)
- # no need to ask for UX confirmation during clone - as user can see what is loaded on source CC
- prob = await restore_complete_doit(incoming, words, file_cleanup=delme,
- ux_confirm=False)
+ prob = await restore_complete_doit(incoming, words, file_cleanup=delme)
if prob:
await ux_show_story(prob, title='FAILED')
### testing/clone_tests.py
@@ -91,8 +91,8 @@ def _clone(source, target):
# _need_keypress(device, KEY_ENTER if target_is_Q else "y", timeout=1000)
# except: pass
- for _ in range(3):
- # need 3 ENTERS - 1. start the process; 2.FTUX; 3. Success story
+ for _ in range(4):
+ # need 4 ENTERS - 1. start; 2. accept XFP; 3. FTUX; 4. Success story
try:
# somehow it works even if it timeouts
# remember that we have only one .socket (fpath is compiled in pyb.py)
@@ -220,4 +220,4 @@ def test_backup_restore_delta_pin():
m = _cap_menu(device_target)
assert "11-11" in m[1]
-# EOF
\ No newline at end of file
+# EOFWhy this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.