Poor Commit Practices Contributed to Coldcard's Low Entropy Vulnerability

Investigation into Coldcard Vulnerability

A developer investigated the recent Coldcard hack by examining the device's firmware commit history. The investigation focused on understanding how a low entropy bug, which led to potential theft of Bitcoin funds, could have been introduced and overlooked.

Commit Message Practices

Software development relies on commit messages to document code changes, explaining what was altered and why. Good practices dictate clear, detailed messages for smaller, focused changes. This allows for easier tracking and debugging, especially in security-critical applications.

The analysis highlighted a significant deviation from these practices in the Coldcard firmware. Specifically, two commits related to the low entropy issue exhibited extremely poor commit message to code change ratios, making it difficult to discern the purpose and impact of the modifications.

Specific Commit Examples

One commit, titled "runs," involved 1534 lines of code changes with a message of only five characters. This commit appears to have configured C code for micropython on the STM32 board used by Coldcards. Another contributing commit had a single-character message, "x," for approximately 1000 lines of code changes. These minimal descriptions for substantial code alterations, particularly in security-sensitive areas, are identified as a critical factor in the bug's introduction and persistence.

Impact on Security

The lack of proper documentation in these commits meant that changes affecting the device's entropy generation, a core security component, were not adequately explained or reviewed. This oversight directly contributed to the low entropy bug, which could compromise the security of user funds. The incident underscores the importance of rigorous development practices, especially for hardware wallets handling sensitive assets.