What changed, and why it matters
This commit only edits a documentation file (docs/limitations.md). It updates descriptions of product limitations, such as noting that a previously reserved PIN code is now available, explaining backup file timestamps, adding a note about unsupported pay-to-pubkey transactions, and renaming a feature section. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.
No security action required. This is a documentation-only commit. Reviewers may optionally verify that the updated documentation accurately reflects current firmware behavior, particularly the PIN code and P2PK statements.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is limited to docs/limitations.md. Changes include: (1) updating the PIN code documentation to state that 999999-999999 is no longer reserved; (2) clarifying that backup file metadata uses firmware release date rather than real time; (3) adding a blank line under a BIP-67 heading; (4) adding a new ‘Pay-to-Pubkey’ section noting P2PK code is untested/unused; (5) renaming the ‘CCC Feature (ColdCard Cosigning)’ section to ‘Spending Policy’ and updating related wording. No source code, build scripts, tests, or cryptographic logic were modified.
Changed components
docs/limitations.mdInspect captured patch +10 / −4
diff --git a/docs/limitations.md b/docs/limitations.md
index 5c2901b..54af45e 100644
--- a/docs/limitations.md
+++ b/docs/limitations.md
@@ -14,11 +14,12 @@
# PIN Codes
- 2-2 through 6-6 in size, numeric digits only
-- pin code 999999-999999 is reserved (means 'clear pin')
+- pin code 999999-999999 was reserved (meaning 'clear pin'), but now available again
# Backup Files
- we don't know what day it is, so meta data on files will not have correct date/time
+- release date of the firmware version that made the file is used instead of true date
- encrypted files produced cannot be changed, and we don't support other tools making them
# Micro SD
@@ -78,6 +79,7 @@
- multisig wallet `name` can only contain printable ASCII characters `range(32, 127)`
### BIP-67
+
- importing multisig from PSBT can ONLY create `sortedmulti(...)` multisig according to BIP-67, DO NOT use with `multi(...)`
- creating airgapped multisig using COLDCARD as coordinator always produces `sortedmulti(...)` multisig according to BIP-67
- COLDCARD import/export [format](https://coldcard.com/docs/multisig/#configuration-text-file-for-multisig) only supports `sortedmulti(...)` multisig according to BIP-67. To import multisig wallet with `multi(...)` use descriptor import [format](https://github.com/bitcoin/bips/blob/master/bip-0383.mediawiki)
@@ -138,6 +140,10 @@ We will summarize transaction outputs as "change" back into same wallet, however
- key derivatation paths must be 12 or less in depth (`MAX_PATH_DEPTH`)
+# Pay-to-Pubkey
+
+- although we have some code for "pay to pubkey" (P2PK not P2PKH), it is untested
+ and unused since this style of payment address is obsolete and largely unused today
# NFC Feature
@@ -202,9 +208,9 @@ We will summarize transaction outputs as "change" back into same wallet, however
- if you have an XFP collision between multiple wallets in SeedVault (ie. two wallets
with same descriptors, but different seeds) you will get false negatives
-# CCC Feature (ColdCard Cosigning)
+# Spending Policy
-- only 12 or 24 word seeds (not XPRV) are accepted for "key C"
+- (Cosign mode) only 12 or 24 word seeds (not XPRV) are accepted for "key C"
- velocity limit:
- based on a max magnitude per txn, and a required minimum block height
gap, based on previous `nLockTime` value in last-signed PSBT.
@@ -213,5 +219,5 @@ We will summarize transaction outputs as "change" back into same wallet, however
- PSBT creator must put in `nLockTime` block heights (most already do to avoid fee sniping)
- maximum of 25 whitelisted addresses can be stored
- Web2FA: any number of mobile devices can be enrolled, but all will have the same shared secret
-- any warning from the PSBT, such as huge fees, will prevent CCC cosign.
+- any warning from the PSBT, such as huge fees, will be blocked by policy.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.