Coldcard multisig parser let a crafted script pass as change and steal it

On 19 December 2019 Coinkite released Coldcard firmware 3.0.6 with a security fix for multisig users, describing a PSBT-tampering issue that could allow a man-in-the-middle to steal funds. Coinkite updated its post with details in March 2020, after the disclosure period, and credits Dmitry Petukhov, who found the issue while integrating the Coldcard into his work. Petukhov published a description of the attack on 30 March 2020.

According to Coinkite, older firmware did not parse multisig scripts tightly enough: an attacker could craft a redeem script that the device read as change returning to the user’s wallet while the funds actually went to the attacker’s keys. Petukhov explains that the parser stopped at the first OP_CHECKMULTISIG and did not check that it was the last opcode, so a script could start with a multisig of the device’s own keys and continue with a second multisig of attacker keys that actually controls the output. Coinkite notes the attack did not require knowing the full xpubs of the signing keys.

Coinkite says it fixed the bug by simplifying the parsing code and, as an extra safeguard, now shows change outputs on the confirmation screen. Only multisig wallets were affected.

What Coinkite advises:

• Multisig users should upgrade to 3.0.6 or later.
• Avoid transmitting xpub values in PSBT files unless they are required.