Bitcoin News said in a post on X that a new technical analysis by Core-Lightning developer ddustin points to a possible origin for the 2021 COLDCARD vulnerability. According to the analysis, the issue may have begun when a developer tried to connect wallet-related Python code, MicroPython C code, and the STM32 hardware random number generator. The custom code appears to have conflicted with an existing MicroPython implementation and may have triggered a compiler error. Evidence cited in the analysis suggests the developer then set MICROPY_HW_ENABLE_RNG to 0 so the firmware could compile. That change had an unintended effect: when users created a new wallet, the firmware no longer used the hardware random number generator and instead fell back to MicroPython’s weaker Yasmarang software random number generator. The related commit message reportedly said only “runs.” The analysis argues the episode is a reminder that developers should not ship security-critical code they do not fully understand, especially when that code is responsible for protecting billions of dollars in Bitcoin.
Bitcoin News said in a post on X that a new technical analysis by Core-Lightning developer ddustin suggests the 2021 COLDCARD vulnerability may have originated when a developer tried to connect wallet Python code, MicroPython C code, and the STM32 hardware random number generator.
The analysis says the custom code appears to have conflicted with MicroPython’s existing implementation and may have triggered a compiler error. Evidence cited in the post shows the developer later set MICROPY_HW_ENABLE_RNG to 0, allowing the firmware to compile.
That change came with an unintended consequence. When users created a new wallet, the firmware stopped using the hardware random number generator and instead fell back to MicroPython’s weaker Yasmarang software random number generator. The developer’s commit message was reportedly just “runs.”
According to the analysis, the case is a reminder that developers should not release security-critical code they do not fully understand, especially when it is meant to protect billions of dollars in Bitcoin.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
