What the developer wrote
Authored by Peter D. Gray
few notes
What changed, and why it matters
This commit only adds documentation notes to a markdown file describing how trick PINs and spending policies interact. There are no code changes, no bug fixes, and no security patches. It is purely informational guidance for users about existing product behavior.
No action required; this is a documentation-only commit. Review the guidance for accuracy if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds a new section to docs/spending-policy.md titled ‘Trick PIN Thoughts’ and subsections ‘Unlock Policy & Wipe’ and ‘Delta Mode and Spending Policy’. It explains threat-model considerations: an attacker who knows the main PIN can detect duress wallets, recommends a wipe PIN instead, notes a trick PIN that mimics an unlock PIN but wipes the seed, and explains that Delta Mode invalidates signed transactions and may wipe seed on sensitive exports. No source code, build files, tests, or configuration were modified.
Changed components
docs/spending-policy.mdInspect captured patch +32 / −0
diff --git a/docs/spending-policy.md b/docs/spending-policy.md
index 3b398a5..deb82bc 100644
--- a/docs/spending-policy.md
+++ b/docs/spending-policy.md
@@ -16,3 +16,35 @@ master secret (not a seed phrase anymore). This process cannot be
reversed, so other funds you may have on the same seed words are
protected. Once you are operating in XPRV mode, you can define a
spending policy and know that it is restricted to only that wallet.
+
+## Trick PIN Thoughts
+
+When doing your game theory w.r.t to bypass mode and this feature,
+remember that you should assume the attacker already has your main
+PIN. That's how they know they cannot spend all your coin, because
+they either tried to, or noticed the menus are very limited. They also
+have all your UTXO locations and total wallet balance (because they
+can export xpubs to any wallet and load balance from there).
+
+Therefore, a trick pin that leads to a duress wallet after giving up
+the bypass unlock PIN does not fool them. Best would be to provide
+a false bypass PIN that is in fact a wipe PIN.
+
+### Unlock Policy & Wipe
+
+We've provided a new trick PIN that pretends to be the unlock
+spending policy pin, so the login sequence is correct... but it
+will wipe the seed in the process. It will be obvious to your
+attackers that you've wiped the seed because the main PIN will lead
+to blank wallet now (no seed loaded).
+
+### Delta Mode and Spending Policy
+
+If, from the start, you gave your "delta mode PIN" to the attackers,
+then when they bypass the policy (after also getting the bypass PIN from you),
+they will still be in Delta Mode.
+
+They could attempt unlimited spending, but transactions signed will
+not be valid. If they try to view the seed words or generally export
+private key material, they may hit many of the "wipe seed if delta mode"
+cases.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.