bugfix: dice roll screen counted key-repeat events as dice rolls
What the developer wrote
Authored by Piotr Duszynski
bugfix: dice roll screen counted key-repeat events as dice rolls
add_dice_rolls() used PressRelease() with no argument, so the digits were not
in need_release and a held digit was re-delivered about every 60ms, each
delivery counted as a roll. Put the digits in need_release, the way
ux_mk4.ux_enter_number already does. A roll now registers on release, so
overlapping presses count once rather than several times.
What changed, and why it matters
This fix corrects a user-interface bug in COLDCARD's dice-roll seed-generation feature. Previously, if a user held down a digit key, the device treated the auto-repeating key events as multiple separate dice rolls, rapidly adding many unintended rolls. After the fix, a held key registers exactly one roll when released, matching how number entry already works elsewhere. This reduces the chance a user accidentally skews their random seed by holding a button too long.
Users generating seeds via dice rolls should update to firmware containing this fix, especially if they rely on manual dice entropy. Developers should review other seed/entropy input screens for similar PressRelease misuse.
Security signals we found
UI input debouncing / key-repeat suppression
Randomness generation quality / user entropy integrity
Behavioral parity with existing hardened input path (ux_enter_number)
Evidence from the diff
In shared/seed.py, add_dice_rolls() instantiated PressRelease() with no need_release set. Because PressRelease defaults to treating all keys as repeatable, holding a digit key caused repeated PressRelease events roughly every 60 ms, each counted as an independent dice roll. The patch passes the acted-on keys (‘123456’, KEY_ENTER, KEY_CANCEL, ‘xy’) to PressRelease(), placing them in need_release so a roll is registered only on key release, eliminating repeat-induced extra rolls. The commit explicitly notes this mirrors ux_mk4.ux_enter_number behavior.
Changed components
shared/seed.pyCOLDCARD dice-roll seed generation screenPressRelease input handling classInspect captured patch +3 / −1
### shared/seed.py
@@ -452,7 +452,9 @@ async def add_dice_rolls(count, seed, judge_them, nwords=None, enforce=False):
counter = {}
md = sha256(seed)
- pr = PressRelease()
+ # no key-repeat on any key we act on: a held digit is one roll, not many
+ # - same idea as ux_mk4.ux_enter_number, which puts its digits in need_release
+ pr = PressRelease('123456' + KEY_ENTER + KEY_CANCEL + 'xy')
# draws initial screen, and returns funct to update count and/or hash
screen_updater = ux_dice_rolling()Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.