do not allow empty BIP-39 passphrase over USB
What the developer wrote
Authored by scgbckbone
do not allow empty BIP-39 passphrase over USB
What changed, and why it matters
This update prevents a COLDCARD hardware wallet from accepting an empty BIP-39 passphrase when the command comes over the USB connection. A BIP-39 passphrase is an extra word or phrase users can add to their seed to create a separate wallet. Previously, an empty passphrase could be sent through USB, which might let software on the connected computer silently access the user's default/no-passphrase wallet without the user typing anything on the device. Now the device rejects empty passphrases over USB, so the user must intentionally enter a passphrase on the device itself.
Users should upgrade to firmware containing this commit. Developers should review whether other USB commands that derive keys or wallets from user input also reject empty or default-equivalent values, and ensure that sensitive passphrase entry remains gated by on-device confirmation.
Security signals we found
Input validation added to USB command handler
Empty-string BIP-39 passphrase now rejected over USB
Potential bypass of on-device passphrase entry UI
Boundary condition fix (zero-length input)
Evidence from the diff
In shared/usb.py, the USBHandler’s BIP-39 passphrase handler now asserts that the decoded passphrase string has non-zero length before calling start_bip39_passphrase(pw). The change adds assert len(pw), 'too short' immediately after UTF-8 decoding. This closes a path where host-side software could supply an empty passphrase argument over USB and potentially trigger passphrase-derived wallet operations equivalent to the no-passphrase/default account, bypassing the device’s own passphrase entry UI.
Changed components
shared/usb.pyUSB BIP-39 passphrase command handlerInspect captured patch +1 / −0
diff --git a/shared/usb.py b/shared/usb.py
index 3e89699..c1b15c2 100644
--- a/shared/usb.py
+++ b/shared/usb.py
@@ -589,6 +589,7 @@ class USBHandler:
assert settings.get("words", True), 'no seed'
assert len(args) < 400, 'too long'
pw = str(args, 'utf8')
+ assert len(pw), 'too short'
assert len(pw) < 100, 'too long'
return start_bip39_passphrase(pw)
Why this scored 64/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.