What the developer wrote
Authored by Jack
Export both Casa keys to microSD
What changed, and why it matters
This commit changes how the Passport hardware wallet exports information for the Casa wallet. Previously, only the master extended public key was written to a microSD card. Now, the file also includes the Casa-specific extended public key at derivation path m/45'. This is a feature enhancement to make Casa multisig setup easier, not a security fix. The change does not appear to introduce a vulnerability, but it does export additional key material to removable storage.
No security action required. As a general defensive measure, users should be aware that the Casa export file on microSD now contains both the master xpub and the m/45' xpub, which reduces the privacy of the exported file if the microSD is lost or shared. This is consistent with intended Casa multisig setup behavior.
Security signals we found
No security-relevant signals detected in the diff
Change exports additional public key material (xpub) to removable storage
No private key material is exposed
No input validation, parsing, or cryptographic operations are modified
Evidence from the diff
The patch in ports/stm32/boards/Passport/modules/wallets/casa.py introduces a constant CASA_PATH = ‘m/45’’ and uses it both for deriving a crypto-account object and for serializing an additional extended public key into the microSD export file. The exported file now contains both the master xpub and the m/45’ xpub. This is a functional change to support Casa’s key-import workflow. There is no evidence in the diff of buffer overflows, path validation bypasses, secret key leakage, or authentication weaknesses.
Changed components
ports/stm32/boards/Passport/modules/wallets/casa.pyCasa wallet export flowmicroSD export file contentInspect captured patch +8 / −1
### ports/stm32/boards/Passport/modules/wallets/casa.py
@@ -11,6 +11,8 @@
from data_codecs.qr_type import QRType
from foundation import ur
+CASA_PATH = "m/45'"
+
def create_casa_export(sw_wallet=None,
addr_type=None,
@@ -34,7 +36,7 @@ def create_casa_export(sw_wallet=None,
is_mainnet = chain.ctype == 'BTC'
network = ur.NETWORK_MAINNET if is_mainnet else ur.NETWORK_TESTNET
- casa_node = sv.derive_path("m/45'")
+ casa_node = sv.derive_path(CASA_PATH)
account = ur.new_crypto_account(
sv.node.public_key(),
sv.node.chain_code(),
@@ -63,7 +65,12 @@ def create_casa_export(sw_wallet=None,
# Top-level, 'master' extended public key ('m/'):
{xpub}
+
+ # Casa extended public key ("m/45'"):
+
+ {casa_xpub}
'''.format(nb=chain.name, xpub=chain.serialize_public(sv.node),
+ casa_xpub=chain.serialize_public(sv.derive_path(CASA_PATH)),
sym=chain.ctype, ct=chain.b44_cointype, xfp=xfp2str(settings.get('xfp')))
return (s, None) # No 'acct_info'Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.