changelog: note temporary-only wallet import fixes
What the developer wrote
Authored by scgbckbone
changelog: note temporary-only wallet import fixes
What changed, and why it matters
This is a one-line changelog note, not the actual code fix. It describes a bug where, if the main wallet was empty and a temporary seed was active, importing wallets or restoring backups would incorrectly become permanent changes to the master wallet instead of staying temporary. The note suggests the real fix happened elsewhere, so this commit alone does not show what code changed or how severe the underlying bug is.
Locate and review the actual code change that this changelog entry refers to; assess whether the temporary/master seed scoping bug is exploitable by an attacker with physical or USB access, and confirm the fix is present in the next release. Treat this commit as documentation-only and not as evidence of remediation by itself.
Security signals we found
Changelog describes a bug affecting seed-scoped wallet operations under a temporary seed
Incorrect scoping could cause temporary seed operations to persist to master wallet
No source code or patch content is included in the commit
Evidence from the diff
The commit only edits releases/Next-ChangeLog.md to add a bugfix note. The note states: with an empty master wallet and an active temporary seed, imports and backup restores were being treated as master-seed changes rather than remaining temporary-only. No source code diff is present, so the actual vulnerability or fix cannot be reviewed from this commit. The behavior implies a logic error in seed-scoped wallet operations, likely in backup restore or import flows, where the code failed to respect the temporary-seed context when the master seed had no existing wallet state.
Changed components
COLDCARD firmware wallet import flowCOLDCARD firmware backup restore flowCOLDCARD firmware temporary seed handlingInspect captured patch +1 / −0
### releases/Next-ChangeLog.md
@@ -13,6 +13,7 @@ This lists the new changes that have not yet been published in a normal release.
verification of dice-roll or coin-flip mixing.
- Bugfix: Simulator crashed on Bless Firmware, due to a desynced LED pipe. Thanks to
[@hitechhayekian](https://github.com/hitechhayekian).
+- Bugfix: With an empty master wallet and an active temporary seed, keep imports and backup restores temporary instead of treating them as master-seed changes.
# Mk Specific Changes
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.