What the developer wrote
Authored by scgbckbone
cleanup: drop unused fetch() params
What changed, and why it matters
This commit removes unused parameters from an internal function called fetch() in the COLDCARD firmware. There is no evidence this change fixes or introduces a security issue; it is purely a code cleanup that simplifies the function signature and removes dead code paths.
No security action required. Treat as routine refactoring. Reviewers may optionally verify that no callers still pass duress_pin or spare_num to fetch().
Security signals we found
No strong security signals were identified.
Evidence from the diff
In shared/pincodes.py, the fetch() method previously accepted duress_pin and spare_num parameters and branched based on them. The commit drops both parameters and the associated branches, leaving only the bypass_tmp parameter and a straightforward call to self.roundtrip(4). The removed parameters appear to have been unused or obsolete, including a legacy mk3 duress-pin retrieval path.
Changed components
shared/pincodes.pyPinLogin.fetch()Inspect captured patch +2 / −10
### shared/pincodes.py
@@ -361,20 +361,12 @@ def change(self, **kws):
# - call new_main_secret() when main secret changes!
# - is_secret_blank and is_successful may be wrong now, re-login to get again
- def fetch(self, duress_pin=None, spare_num=0, bypass_tmp=False):
+ def fetch(self, bypass_tmp=False):
if self.tmp_value and not bypass_tmp:
# must make a copy here, and must be mutable instance so not reused
- if spare_num:
- return bytearray(AE_SECRET_LEN)
return bytearray(self.tmp_value)
- if duress_pin is None:
- secret = self.roundtrip(4, spare_num=spare_num)
- else:
- # mk3 and earlier
- secret = self.roundtrip(4, old_pin=duress_pin, get_duress_secret=True)
-
- return secret
+ return self.roundtrip(4)
def ls_fetch(self):
# get the "long secret"Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.