Odaily Planet Daily reports that Bitcoin News posted on X that a new technical analysis by Core-Lightning developer ddustin suggests the 2021 COLDCARD vulnerability may have originated when the developer attempted to integrate Python code for connecting the wallet, C code for MicroPython, and the STM32 hardware random number generator. This custom code appears to have conflicted with MicroPython’s existing implementation, potentially triggering a compiler error. Evidence shows the developer subsequently set MICROPY_HW_ENABLE_RNG to 0, allowing the firmware to compile successfully. This change had unintended consequences: when users created new wallets, the firmware no longer used the hardware random number generator but instead fell back to MicroPython’s weaker Yasmarang software random number generator. The developer’s commit message left only “runs.” The analysis warns developers not to release security-critical code they do not fully understand—especially when safeguarding billions of dollars in Bitcoin.
COLDCARD vulnerability may stem from compiler bypass in 2021
KuCoinFlashShare
Summary
A new analysis by Core-Lightning developer ddustin suggests that the 2021 COLDCARD vulnerability may have stemmed from conflicts between Python wallet code, MicroPython C code, and the STM32 hardware RNG. Developers set MICROPY_HW_ENABLE_RNG to 0 to resolve a compiler error, resulting in the use of the weaker Yasmarang RNG during wallet creation. This issue underscores the importance of monitoring altcoins for security updates. Technical indicators point to continued scrutiny of hardware wallet implementations.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.