Require fingerprint for Unchained export
What the developer wrote
Authored by Jack
Require fingerprint for Unchained export
What changed, and why it matters
This commit tightens how Passport retrieves the wallet's fingerprint when exporting data for the Unchained wallet. Previously, if the fingerprint setting was missing, the code would silently fall back to a value of 0. Now it requires the actual fingerprint to be present. This is a hardening change: a missing or corrupted fingerprint setting could have led to an incorrect or invalid export rather than a clearly wrong one, which could confuse wallet software or, in worst-case scenarios, affect how multisig addresses are derived.
Treat as a minor hardening fix. Verify that the absence of xfp now raises a clear user-facing error rather than crashing silently, and confirm that other wallet export modules do not have similar default-zero fingerprint fallbacks. No urgent action is indicated unless Passport supports a path where xfp can legitimately be absent during export.
Security signals we found
Silent fallback to a default/placeholder cryptographic identifier removed
Fingerprint now required rather than defaulting to zero
Export of multisig/coordination data (Unchained) affected
Single-line hardening change with no explicit vulnerability disclosure
Evidence from the diff
In ports/stm32/boards/Passport/modules/wallets/unchained.py, the call settings.get(‘xfp’, 0) was changed to settings.get(‘xfp’). The old default of 0 meant that if the extended fingerprint (xfp) setting was absent, the code would use a zero fingerprint in the Unchained export CBOR. Removing the default causes settings.get(‘xfp’) to raise an exception if the value is missing, preventing a silent fallback to an invalid/placeholder fingerprint. This is a defensive fix that enforces data integrity for the exported HD key metadata.
Changed components
ports/stm32/boards/Passport/modules/wallets/unchained.pyUnchained wallet export flowExtended fingerprint (xfp) handlingInspect captured patch +1 / −1
### ports/stm32/boards/Passport/modules/wallets/unchained.py
@@ -93,7 +93,7 @@ def create_unchained_export(sw_wallet=None,
chain = chains.current_chain()
with stash.SensitiveValues() as sv:
node = sv.derive_path("m/45'")
- source_fingerprint = swab32(settings.get('xfp', 0))
+ source_fingerprint = swab32(settings.get('xfp'))
cbor = create_unchained_hdkey_cbor(node.public_key(),
node.chain_code(),
source_fingerprint,Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.