fix SSSP unable to find unlock policy PIN
What the developer wrote
Authored by scgbckbone
fix SSSP unable to find unlock policy PIN
What changed, and why it matters
This is a small bug fix in the COLDCARD hardware wallet's 'trick PIN' feature. Trick PINs let users set up special PINs that do things like wipe the device or unlock specific spending policies. The fix makes the device refresh its trick-PIN list before looking for a PIN that unlocks a spending policy. Without the refresh, the device might fail to find a newly added or changed unlock-policy PIN, which could leave a legitimate user unexpectedly unable to access funds or use a protective feature as intended. There is no direct evidence in the commit that this is exploitable by an attacker.
Treat as a routine bug fix with possible reliability/security implications. Users relying on trick PINs with spending-policy unlock should ensure they upgrade to a firmware release containing this fix. No immediate incident response is warranted based on the diff alone. If a CVE or advisory is later published, reassess.
Security signals we found
State synchronization bug in security-critical PIN lookup
Trick PIN / duress feature correctness fix
No explicit security framing by vendor in commit message
Evidence from the diff
In shared/trick_pins.py, the method that searches for a trick PIN configured to unlock a spending policy (TCA_SP_UNLOCK) now calls self.reload() before iterating self.tp. The reload() presumably re-reads the persisted trick-PIN set from storage. Previously, if the in-memory copy was stale (e.g., after a policy was added or updated without a prior reload), the search could return None and the unlock-policy PIN would not be found. This is a one-line state-synchronization fix; it does not change access-control logic or add new checks.
Changed components
shared/trick_pins.pyTrickPinMgmt unlock-policy PIN lookupCOLDCARD trick-PIN / spending-policy unlock featureInspect captured patch +1 / −0
diff --git a/shared/trick_pins.py b/shared/trick_pins.py
index 6058c68..8466693 100644
--- a/shared/trick_pins.py
+++ b/shared/trick_pins.py
@@ -303,6 +303,7 @@ class TrickPinMgmt:
# if spending policy defined, this PIN allows adjustment
# - not TRICK bypass choices, like ones that wipe
# - could be multiple, but only first returned.
+ self.reload()
for k, (sn,flags,arg) in self.tp.items():
if (flags == TC_FW_DEFINED) and (arg == TCA_SP_UNLOCK):
return k
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.