GlcoinCore/mempool
1
0
Fork 0
mirror of https://github.com/mempool/mempool.git synced 2026-08-13 12:33:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

docs: add faq coldcard funds risks

Browse source
This commit is contained in:
rodribp 2026-08-12 00:43:16 -06:00
parent 279741517e
commit dbe1215935
No known key found for this signature in database
GPG key ID: DBB99FAE51E608F0
2 changed files with 13 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
frontend/src/app/docs/api-docs/api-docs-data.ts
View file

@ -12938,6 +12938,13 @@ export const faqData = [
fragment: 'how-can-i-share-or-verify-taproot-scripts',
title: 'How can I share or verify Taproot scripts?',
},
{
type: 'endpoint',
category: 'advanced',
showConditions: bitcoinNetworks,
fragment: 'why-may-my-multisig-funds-be-at-risk',
title: 'Why may my multisig wallet funds be at risk?',
},
{
type: 'category',
category: 'self-hosting',

6
frontend/src/app/docs/api-docs/api-docs.component.html
View file

@ -547,3 +547,9 @@
<ng-template type="address-lookup-issues">
<p>If you're getting errors when doing address lookups, it's probably because of your Electrum server backend.</p><p>Mempool uses an Electrum server to do address lookups. There are several implementations of the Electrum server protocol, and Mempool can use any of them, but the implementation you use affects performance:</p><ol><li><a href="https://github.com/romanz/electrs" target="_blank">romanz/electrs</a>. This is a common choice for its low resource requirements, and most full-node distros use it. But while this implementation works great for basic queries, it will struggle with heavier ones (e.g. looking up addresses with many transactions)—especially when running on low-power hardware like a Raspberry Pi.</li><li><a href="https://github.com/cculianu/Fulcrum" target="_blank">Fulcrum</a>. Fulcrum requires more resources than romanz/electrs but it can still run on a Raspberry Pi, and it handles heavy queries much more efficiently. If you're having issues with romanz/electrs, Fulcrum is worth a try.</li><li><a href="https://github.com/mempool/electrs" target="_blank">mempool/electrs</a>. If you have stronger hardware, you could consider running mempool/electrs, the backend that powers mempool.space. It's a fork of Blockstream's Esplora, which is in turn a fork of romanz/electrs, intended for maximum performance and larger-scale deployments.</li></ol>
</ng-template>
<ng-template type="why-may-my-multisig-funds-be-at-risk">
<p>If a transaction reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a <a href="https://coldcard.com/" target="_blank">Coldcard</a> with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds may be at elevated risk of theft while unconfirmed. </p>
<p>If an address has been used and reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a <a href="https://coldcard.com/" target="_blank">Coldcard</a> with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds in the address are vulnerable.</p>
<p><a href="https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/" target="_blank">See Coinkite’s advisory.</a></p>
</ng-template>