fix SSSP test drive to actually enforce policy
What the developer wrote
Authored by scgbckbone
fix SSSP test drive to actually enforce policy
What changed, and why it matters
This commit fixes a bug in the COLDCARD firmware's 'SSSP test drive' feature. Previously, the code that checks whether the feature is enabled did not properly recognize the special 'test drive' mode, and it called the wrong method when approving transactions. The fix makes the test drive mode correctly activate the feature and uses the intended transaction-approval routine. In practical terms, a user in test-drive mode might have been unable to use the feature as designed, or the wrong internal path could have led to an approval that did not enforce the intended spending policy.
Treat this as a security-relevant bug fix and include it in the next firmware release. Review whether perform_web2fa still exists elsewhere and whether it lacks policy enforcement. Audit other hobbled_mode checks for similar gaps. If SSSP is a marketed security feature, consider issuing a short release note explaining that test-drive mode now correctly enforces policy.
Security signals we found
Policy enforcement bypass in test-drive mode
Incorrect method name used for web-based 2FA transaction approval
Spending-policy check incomplete for hobbled_mode == 2
Evidence from the diff
In shared/ccc.py, SSSPFeature.is_enabled() now imports pa from pincodes and returns True when pa.hobbled_mode == 2, explicitly handling the ‘test drive enabled’ state. Previously it only relied on sssp_spending_policy(‘en’), which evidently did not cover the test-drive case. Additionally, SSSPFeature.sign_transaction() now calls cls.get_policy().web2fa_challenge(‘Approve Transaction’) instead of perform_web2fa(‘Approve Transaction’). The change suggests perform_web2fa was either a misnomer, a less strict wrapper, or did not enforce the policy checks that web2fa_challenge performs.
Changed components
shared/ccc.pySSSPFeature classSSSPFeature.is_enabled()SSSPFeature.sign_transaction()Inspect captured patch +5 / −1
diff --git a/shared/ccc.py b/shared/ccc.py
index 37d4255..fa80879 100644
--- a/shared/ccc.py
+++ b/shared/ccc.py
@@ -162,6 +162,10 @@ class SSSPFeature:
@classmethod
def is_enabled(cls):
+ from pincodes import pa
+ if pa.hobbled_mode == 2:
+ # test drive enabled
+ return True
return sssp_spending_policy('en')
@classmethod
@@ -215,7 +219,7 @@ class SSSPFeature:
# - and we have approved other elements of the spending policy.
# - could show MS wallet name, or txn details but will not because that is
# an info leak to Coinkite... and we just don't want to know.
- await cls.get_policy().perform_web2fa('Approve Transaction')
+ await cls.get_policy().web2fa_challenge('Approve Transaction')
class CCCFeature:
Why this scored 57/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.