hygiene: duress wallet activate - wipe before getting slot data
What the developer wrote
Authored by scgbckbone
hygiene: duress wallet activate - wipe before getting slot data
What changed, and why it matters
This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in which sensitive wallet data could remain in memory if the device is in Delta Mode (a limited, coerced-access mode). There is no direct evidence in the commit that an actual leak was exploited; it reads as a precautionary hardening change.
Treat as a low-to-moderate hardening fix. Review whether other secret-loading paths in trick_pins.py or stash.py perform similar lookups before Delta Mode wipes, and consider aligning them. No urgent incident response is indicated by the commit alone.
Security signals we found
secret-handling order-of-operations change
Delta Mode coercer/wipe scenario
duress wallet secret loading
defensive hygiene patch
Evidence from the diff
In shared/trick_pins.py, activate_wallet() previously called tp.get_by_pin(pin) to retrieve the duress wallet slot, then called wipe_if_deltamode(). The patch reverses the order: wipe_if_deltamode() now runs before get_by_pin(). The commit message explains that loading a duress wallet secret is ‘secret-revealing’ and that in Delta Mode it would give a coercer working keys, so the device should wipe instead. By wiping first, the code ensures that if Delta Mode triggers a wipe, no duress-slot lookup or secret-loading occurs while sensitive state may still be present. The change is small (3 lines moved) and does not alter the user-visible duress-wallet behavior under normal operation.
Changed components
shared/trick_pins.pyduress wallet activation flowDelta Mode wipe logicInspect captured patch +3 / −3
### shared/trick_pins.py
@@ -805,14 +805,14 @@ async def activate_wallet(self, m, l, item):
so you may perform transactions with it.''')
if ch != 'y': return
- b, slot = tp.get_by_pin(pin)
- assert slot
-
# loading a duress wallet's secret is a secret-revealing action; in
# Delta Mode it would hand the coercer working keys, so wipe instead
from utils import wipe_if_deltamode
wipe_if_deltamode()
+ b, slot = tp.get_by_pin(pin)
+ assert slot
+
# TC_BLANK_WALLET here would be nice, but no support working w/ fake empty secret
# emulate stash.py encodingWhy this scored 56/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.