What the developer wrote
Authored by Peter D. Gray
hide empty menu
What changed, and why it matters
This commit hides the 'Spending Policy' menu item when the COLDCARD wallet does not actually have a real secret key loaded. Previously, the menu item was always shown, even though it would be empty or non-functional without a real secret. This is a minor UI cleanup rather than a serious security fix.
No urgent action needed. Treat as routine UI hardening. If auditing, verify that has_real_secret correctly reflects the intended device state and that the SpendingPolicySubMenu behaves safely if accessed through other paths.
Security signals we found
UI menu item now gated by has_real_secret predicate
Prevents navigation to potentially empty/inapplicable spending policy screen
No cryptographic, authentication, or memory-safety changes
Evidence from the diff
The change adds a predicate=has_real_secret condition to the ‘Spending Policy’ menu item in shared/flow.py. This means the menu entry is only displayed when the device has a real secret loaded. The shortcut ‘s’ remains attached. The change prevents users from navigating to an empty or inapplicable spending policy menu in states such as no-seed or ephemeral-only operation.
Changed components
shared/flow.pyAdvancedNormalMenuSpending Policy menu itemInspect captured patch +1 / −1
diff --git a/shared/flow.py b/shared/flow.py
index 2da426e..c0a2579 100644
--- a/shared/flow.py
+++ b/shared/flow.py
@@ -411,7 +411,7 @@ AdvancedNormalMenu = [
MenuItem("View Identity", f=view_ident),
MenuItem("Temporary Seed", menu=make_ephemeral_seed_menu),
MenuItem("Key Teleport (start)", f=kt_start_rx, predicate=version.has_qr),
- MenuItem("Spending Policy", menu=SpendingPolicySubMenu, shortcut='s'),
+ MenuItem("Spending Policy", menu=SpendingPolicySubMenu,shortcut='s',predicate=has_real_secret),
MenuItem('Paper Wallets', f=make_paper_wallet),
MenuItem('NFC Tools', predicate=nfc_enabled, menu=NFCToolsMenu, shortcut=KEY_NFC),
MenuItem("Danger Zone", menu=DangerZoneMenu, shortcut='z'),
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.