OSC-2026-0022 · github.com/Coldcard/firmware
info clean-run grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/Coldcard/firmware
- Commit
- c849c4e04a978335937a0fd0c96e76f5bd70bbb6
- Scope path
- shared/psbt.py
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/tx-authorization-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- d8412dbb439d3806510438ae6665165208c767ccc44b8d696e50593b2a106ee5
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent Grok re-audit of transaction-authorization class on Coldcard post-RNG-fix HEAD c849c4e0. In scope: change-output validation and failure direction, multisig script reconstruction, input-value provenance. NOT: fee display polish, USB/NFC, firmware update, entropy. Cross-model counterpart to OSC-2026-0010.
Findings
info OSC-2026-0022-F1 unreviewed
No defect found in scope. Change classification fails closed: FraudulentChangeOutput on path/pubkey mismatch (shared/psbt.py validate ~434-570); multisig reconstructs full script from enrolled xpubs (multisig.py validate_script). sign_it re-checks change paths before producing signatures (~2141-2170). Inputs require UTXO data to sign; non-provably-segwit witness-only amounts do not invent a fake fee. When multisig checks are user-disabled, outputs are forced is_change=False (shown as external), not hidden. Strictest change handling among signers compared in this multi-model pass. Agreement with OSC-2026-0010.