Coldcard accepted hidden change paths that could hold funds to ransom

On 1 November 2019 Coinkite released Coldcard firmware 3.0.2 and a post crediting @TheCharlatan for reporting that a valid PSBT could send a transaction’s change to a location the user does not know. The researcher, writing as sedited together with Kaspar Etter of Shift Cryptosecurity, published the full details on 13 November 2019.

According to the researchers, the Coldcard neither displayed nor restricted the derivation path of change outputs. A malicious or modified wallet app on the computer could set a change path with extremely large indexes, so the change would be practically unspendable without knowing the exact path, and the attacker could demand a ransom for it. A second finding concerned receive addresses: the path parser accepted whitespace such as newlines, so the path shown on screen could differ from the one actually used, with the real end of the path pushed off-screen.

Coinkite states the attack requires knowing the victim’s xpub and a man-in-the-middle position on the PSBT files, and that keeping the original PSBT makes tampering easy to detect. Firmware 3.0.2 checks derivation paths against a conservative set of rules and shows a “Troublesome Change Outs” warning; Coinkite says these are warnings for now and may become fatal errors later. The researchers write that the release notes did not clearly flag a security fix and that they received two Coldcards and a mug rather than a bounty. They also report that the BitBox01 had been affected by similar attacks, fixed in March 2019.

What Coinkite advises:

• Do not include xpub values in PSBT files and treat your xpubs as confidential.