Skip to content

Harden PSBTv2 parsing - #818

Merged
doc-hex merged 1 commit into
Coldcard:masterfrom
scgbckbone:fix/master-psbtv2-hardening
Sep 21, 2026
Merged

doc-hex merged 1 commit into
Coldcard:masterfrom
scgbckbone:fix/master-psbtv2-hardening

Conversation

@scgbckbone

Copy link
Copy Markdown
Collaborator

Summary

  • reject keydata on BIP370 singleton global, input, and output fields
  • require exact canonical CompactSize encodings for global input/output counts
  • require PSBTv2 to explicitly provide global version 2
  • add focused regressions for all affected fields and validation boundaries

@scgbckbone
scgbckbone force-pushed the fix/master-psbtv2-hardening branch from cb4bc92 to 37b7af6 Compare September 11, 2026 09:22
@doc-hex
doc-hex merged commit 5e0dbd0 into Coldcard:master Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants