bugfix: block Seed Vault XOR access in Delta Mode
What the developer wrote
Authored by scgbckbone
bugfix: block Seed Vault XOR access in Delta Mode
What changed, and why it matters
This update fixes a bug in the COLDCARD hardware wallet where a security mode called 'Delta Mode' could still access the Seed Vault through a feature called Seed XOR restore. Delta Mode is meant to restrict what an attacker or unauthorized user can do with the device. The fix blocks that access path. The bug was reported by someone named Rety.
Treat as a security bugfix. Review whether other seed-access flows (restore, export, backup, etc.) also enforce Delta Mode restrictions consistently. No immediate exploit code is present in the diff, so the fix should be validated and included in the next release.
Security signals we found
Delta Mode bypass: Seed Vault entries were reachable through Seed XOR restore despite Delta Mode restrictions
Information disclosure / unauthorized seed access risk
Vendor-acknowledged bugfix with external reporter credit
Evidence from the diff
In shared/xor_seed.py, the done_cb() callback iterates over Seed Vault entries during a Seed XOR restore operation. The patch adds a check that skips each Seed Vault record if the device is currently in Delta Mode (pa.is_deltamode()). This prevents a user in Delta Mode from reading or using stored seed entries via the XOR restore flow. The change is small and localized, and the changelog explicitly calls it a bugfix and credits Rety for the report.
Changed components
shared/xor_seed.pySeed XOR restore featureSeed VaultDelta Mode policy enforcementInspect captured patch +3 / −0
### releases/Next-ChangeLog.md
@@ -5,6 +5,8 @@ This lists the new changes that have not yet been published in a normal release.
# Shared Improvements - Both Mk and Q
- Bugfix: Detect RNG_SR_SEIS and RNG_SR_SECS, retry safely, and fail closed on persistent faults.
+- Bugfix: Prevent access to Seed Vault entries through Seed XOR restore in Delta Mode. Thanks to
+ Rety for reporting this.
# Mk Specific Changes
### shared/xor_seed.py
@@ -296,6 +296,7 @@ async def done_cb(data):
# filter only those that are correct length and type from seed vault
opt = []
for i, rec in enumerate(seed_vault_iter()):
+ if pa.is_deltamode(): continue
raw = deserialize_secret(rec.encoded)
nw = SecretStash.is_words(raw)Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.