bugfix: NFC verify address wrong error message
What the developer wrote
Authored by scgbckbone
bugfix: NFC verify address wrong error message
What changed, and why it matters
This commit fixes a minor user-interface bug in the COLDCARD hardware wallet's NFC 'Verify Address' feature. Previously, if the NFC read was cancelled or returned no address, the code could produce a confusing or wrong error message because it tried to unpack a missing result. The fix checks whether the NFC read actually returned anything before proceeding, and a new test confirms that cancelling the prompt no longer appears to 'crash' or mislead the user. There is no indication this bug could be used to steal funds or bypass security.
No security action required; treat as a normal bugfix. Users may include it in regular firmware updates for improved NFC UX, but it does not address a vulnerability.
Security signals we found
UI-only bugfix with no security primitive changed
No input passed to cryptographic or ownership code when read fails
New regression test asserts graceful handling of cancelled/empty NFC reads
Evidence from the diff
In shared/nfc.py, verify_address_nfc() previously awaited self.read_address() and immediately destructured its return value as ‘_, addr, args =’. If read_address() returned None (e.g., user cancelled or no tag data), the tuple unpack would raise a TypeError, leading to an incorrect/unexpected error screen. The patch stores the return value, returns early if it is None, and only then unpacks. The changelog and new unit test describe the visible symptom as an incorrect error message / apparent crash on cancel. No cryptographic, authorization, or memory-safety changes are present.
Changed components
shared/nfc.py: NFCHandler.verify_address_nfc()testing/test_nfc.py: new test_verify_address_nfc_cancelInspect captured patch +38 / −4
diff --git a/releases/Next-ChangeLog.md b/releases/Next-ChangeLog.md
index e1de2b3..db26c4c 100644
--- a/releases/Next-ChangeLog.md
+++ b/releases/Next-ChangeLog.md
@@ -12,6 +12,7 @@ This lists the new changes that have not yet been published in a normal release.
- Bugfix: Yikes when using "Send Password" on entry with password None field
- Bugfix: Do not show "Saving..." UX after failed Notes & Passwords import
- Bugfix: Incorrect error message caused by error in Verify/Decrypt Backup
+- Bugfix: NFC Verify Address raised incorrect error message
# Mk Specific Changes
diff --git a/shared/nfc.py b/shared/nfc.py
index 115a386..fe8e1d4 100644
--- a/shared/nfc.py
+++ b/shared/nfc.py
@@ -747,10 +747,11 @@ class NFCHandler:
async def verify_address_nfc(self):
# Get an address or complete bip-21 url even and search it... slow.
- _, addr, args = await self.read_address()
- if addr:
- from ownership import OWNERSHIP
- await OWNERSHIP.search_ux(addr, args)
+ res = await self.read_address()
+ if not res: return
+ _, addr, args = res
+ from ownership import OWNERSHIP
+ await OWNERSHIP.search_ux(addr, args)
async def read_extended_private_key(self):
f = lambda x: x.decode().strip() if b"prv" in x else None
diff --git a/testing/test_nfc.py b/testing/test_nfc.py
index ada8e83..e2864c5 100644
--- a/testing/test_nfc.py
+++ b/testing/test_nfc.py
@@ -666,4 +666,36 @@ def test_nfc_share_files(fname, mode, ftype, nfc_read_json, nfc_read_text,
assert res == contents
os.remove(f'{sim_root_dir}/MicroSD/' + fname)
+def test_verify_address_nfc_cancel(goto_home, pick_menu_item, press_cancel,
+ cap_story, enable_nfc, cap_menu, nfc_write,
+ nfc_write_text):
+ # pressing cancel during 'Verify Address' NFC prompt must not "crash".
+ enable_nfc()
+ goto_home()
+ pick_menu_item("Advanced/Tools")
+ pick_menu_item("NFC Tools")
+ pick_menu_item("Verify Address")
+ time.sleep(0.1)
+ press_cancel()
+ time.sleep(0.1)
+ assert "Verify Address" in cap_menu()
+
+ pick_menu_item("Verify Address")
+ nfc_write_text("empty")
+ time.sleep(0.1)
+ title, story = cap_story()
+ assert "Unable to find address from NFC data" in story
+ press_cancel()
+ time.sleep(.1)
+ assert "Verify Address" in cap_menu()
+
+ pick_menu_item("Verify Address")
+ nfc_write(b"empty")
+ time.sleep(0.1)
+ title, story = cap_story()
+ assert "No tag data" in story
+ press_cancel()
+ time.sleep(.1)
+ assert "Verify Address" in cap_menu()
+
# EOF
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.