From 63c4330174472c632567fad8c1379e8dc5b10804 Mon Sep 17 00:00:00 2001 From: rodribp Date: Wed, 12 Aug 2026 00:42:23 -0600 Subject: [PATCH 1/4] feat: coldcard warning on address page --- .../components/address/address.component.html | 11 +++++++ .../components/address/address.component.scss | 17 +++++++++++ .../components/address/address.component.ts | 30 +++++++++++++++++++ 3 files changed, 58 insertions(+) diff --git a/frontend/src/app/components/address/address.component.html b/frontend/src/app/components/address/address.component.html index f05caf371..7c210c003 100644 --- a/frontend/src/app/components/address/address.component.html +++ b/frontend/src/app/components/address/address.component.html @@ -1,4 +1,7 @@
+ @if (showColdcardWarning && !isLoadingAddress && !error) { + + }

Address

@@ -16,6 +19,7 @@
+
@@ -261,6 +265,13 @@
+ + + + Confidential diff --git a/frontend/src/app/components/address/address.component.scss b/frontend/src/app/components/address/address.component.scss index 06e15ad67..499a4c85f 100644 --- a/frontend/src/app/components/address/address.component.scss +++ b/frontend/src/app/components/address/address.component.scss @@ -133,3 +133,20 @@ h1 { padding-bottom: 0; font-size: 0.8rem; } + + +.coldcard-warning { + display: flex; + align-items: center; + position: relative; + background-color: #b71c1c; + border-color: #b71c1c; + a { + color: #fff; + } +} + +.btn-close:hover, +.btn-close:focus { + opacity: 1; +} \ No newline at end of file diff --git a/frontend/src/app/components/address/address.component.ts b/frontend/src/app/components/address/address.component.ts index e11d7cfa4..b62977d7f 100644 --- a/frontend/src/app/components/address/address.component.ts +++ b/frontend/src/app/components/address/address.component.ts @@ -14,6 +14,7 @@ import { seoDescriptionNetwork } from '@app/shared/common.utils'; import { AddressInformation } from '@interfaces/node-api.interface'; import { AddressTypeInfo } from '@app/shared/address-utils'; import { extractTapLeaves, fillTapTree, convertTextToBuffer, PsbtKeyValue } from '@app/shared/transaction.utils'; +import { StorageService } from '@app/services/storage.service'; class AddressStats implements ChainStats { address: string; @@ -138,6 +139,8 @@ export class AddressComponent implements OnInit, OnDestroy { now = Date.now() / 1000; balancePeriod: 'all' | '1m' = 'all'; + showColdcardWarning: boolean = false; + private tempTransactions: Transaction[]; private timeTxIndexes: number[]; private lastTransactionTxId: string; @@ -151,6 +154,7 @@ export class AddressComponent implements OnInit, OnDestroy { private apiService: ApiService, private seoService: SeoService, private formBuilder: UntypedFormBuilder, + private storageService: StorageService, ) { } ngOnInit(): void { @@ -204,6 +208,7 @@ export class AddressComponent implements OnInit, OnDestroy { this.seoService.setTitle($localize`:@@address.component.browser-title:Address: ${this.addressString}:INTERPOLATION:`); this.seoService.setDescription($localize`:@@meta.description.bitcoin.address:See mempool transactions, confirmed transactions, balance, and more for ${this.stateService.network==='liquid'||this.stateService.network==='liquidtestnet'?'Liquid':'Bitcoin'}${seoDescriptionNetwork(this.stateService.network)} address ${this.addressString}:INTERPOLATION:.`); + this.showColdcardWarning = false; this.addressTypeInfo = new AddressTypeInfo(this.stateService.network || 'mainnet', this.addressString); return merge( @@ -337,6 +342,8 @@ export class AddressComponent implements OnInit, OnDestroy { } else { this.setBalancePeriod('1m'); } + + this.updateShowColdcardWarning(); }, (error) => { console.log(error); @@ -652,6 +659,29 @@ export class AddressComponent implements OnInit, OnDestroy { } } + updateShowColdcardWarning() { + const showCCWarningPref = this.storageService.getValue('showAddrColdcardWarning'); + + if (showCCWarningPref && showCCWarningPref === 'false') { + return; + } + + if (!['p2sh', 'v0_p2wsh', 'p2sh-p2wsh'].includes(this.addressTypeInfo.type) || !this.addressTypeInfo.isMultisig || this.addressTypeInfo.network !== 'mainnet') { + return; + } + + if (this.chainStats.balance === 0 && this.mempoolStats.balance === 0) { + return; + } + + this.showColdcardWarning = true; + } + + dismissWarning() { + this.storageService.setValue('showAddrColdcardWarning', 'false'); + this.showColdcardWarning = false; + } + ngOnDestroy(): void { this.mainSubscription.unsubscribe(); this.mempoolTxSubscription.unsubscribe(); From 279741517ee19661838e9382d542c1236b02ce85 Mon Sep 17 00:00:00 2001 From: rodribp Date: Wed, 12 Aug 2026 00:42:43 -0600 Subject: [PATCH 2/4] feat: coldcard warning on transaction page --- .../transactions-list.component.html | 6 ++++ .../transactions-list.component.scss | 16 +++++++++ .../transactions-list.component.ts | 35 +++++++++++++++++++ 3 files changed, 57 insertions(+) diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.html b/frontend/src/app/components/transactions-list/transactions-list.component.html index 41633a0a7..542e740b7 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.html +++ b/frontend/src/app/components/transactions-list/transactions-list.component.html @@ -21,6 +21,12 @@ Warning! This transaction involves deceptively similar addresses. It may be an address poisoning attack.
} + @if (showColdcardWarning) { + + }
diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.scss b/frontend/src/app/components/transactions-list/transactions-list.component.scss index 81b097c47..004adc994 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.scss +++ b/frontend/src/app/components/transactions-list/transactions-list.component.scss @@ -416,6 +416,22 @@ h2 { } } +.coldcard-warning { + display: flex; + align-items: center; + position: relative; + background-color: #b71c1c; + border-color: #b71c1c; + a { + color: #fff; + } +} + +.btn-close:hover, +.btn-close:focus { + opacity: 1; +} + @keyframes acceleratePulse { 0% { background-color: #653b9c; box-shadow: #ad7de57f 0px 0px 12px -2px; } 50% { background-color: #8457bb; box-shadow: #ad7de5 0px 0px 18px -2px;} diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.ts b/frontend/src/app/components/transactions-list/transactions-list.component.ts index 45659a5b6..a83b8dc18 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.ts +++ b/frontend/src/app/components/transactions-list/transactions-list.component.ts @@ -72,6 +72,7 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { showTaprootControlBlock: { [vinIndex: number]: boolean } = {}; showOrdData: { [key: string]: { show: boolean; inscriptions?: Inscription[]; runestone?: Runestone, runeInfo?: { [id: string]: { etching: Etching; txid: string; } }; } } = {}; similarityMatches: Map> = new Map(); + showColdcardWarning: boolean = false; selectedSig: { txIndex: number, vindex: number, sig: SigInfo } | null = null; sigHighlights: { vin: boolean[], vout: boolean[] } = { vin: [], vout: [] }; @@ -186,6 +187,7 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { }); this.updateAddressSimilarities(); + this.updateShowColdcardWarning(); } refreshPrice(): void { @@ -476,6 +478,33 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { } } + updateShowColdcardWarning(): void { + const showCCWarningPref = this.storageService.getValue('showTxColdcardWarning'); + // there's only one tx, it's the tx page, it's unconfirmed, it contains inputs that are p2sh, v0_p2wsh or p2sh-p2wsh, is multisig and network is mainnet + if (showCCWarningPref && showCCWarningPref === 'false') { + return; + } + + if (!this.transactionPage || this.txPreview) { + return; + } + + if (this.transactions.length > 1 || this.transactions[0].status.confirmed) { + return; + } + + const vinPossibleCC: Vin[] = this.transactions[0].vin.filter((input: Vin) => { + const addressTypeInfo = new AddressTypeInfo(this.network || 'mainnet', input.prevout.scriptpubkey_address, input.prevout?.scriptpubkey_type as AddressType, [input]); + return ['p2sh', 'v0_p2wsh', 'p2sh-p2wsh'].includes(addressTypeInfo.type) && !!addressTypeInfo.isMultisig && addressTypeInfo.network === 'mainnet'; + }); + + if (vinPossibleCC.length === 0) { + return; + } + + this.showColdcardWarning = true; + } + // assume any address with 12 or more contiguous repeated substrings is fake fakeScriptHashRegex = new RegExp(/(.+?)\1{11,}/); isFakeScripthash(vout: Vout): boolean { @@ -713,6 +742,12 @@ export class TransactionsListComponent implements OnInit, OnChanges, OnDestroy { } } + dismissWarning(): void { + this.storageService.setValue('showTxColdcardWarning', 'false'); + this.showColdcardWarning = false; + this.ref.markForCheck(); + } + ngOnDestroy(): void { this.outspendsSubscription.unsubscribe(); this.currencyChangeSubscription?.unsubscribe(); From dbe12159352060549837cd0ec0ec7d222650d2c8 Mon Sep 17 00:00:00 2001 From: rodribp Date: Wed, 12 Aug 2026 00:43:16 -0600 Subject: [PATCH 3/4] docs: add faq coldcard funds risks --- frontend/src/app/docs/api-docs/api-docs-data.ts | 7 +++++++ frontend/src/app/docs/api-docs/api-docs.component.html | 6 ++++++ 2 files changed, 13 insertions(+) diff --git a/frontend/src/app/docs/api-docs/api-docs-data.ts b/frontend/src/app/docs/api-docs/api-docs-data.ts index 7544fd406..9a4baeab9 100644 --- a/frontend/src/app/docs/api-docs/api-docs-data.ts +++ b/frontend/src/app/docs/api-docs/api-docs-data.ts @@ -12938,6 +12938,13 @@ export const faqData = [ fragment: 'how-can-i-share-or-verify-taproot-scripts', title: 'How can I share or verify Taproot scripts?', }, + { + type: 'endpoint', + category: 'advanced', + showConditions: bitcoinNetworks, + fragment: 'why-may-my-multisig-funds-be-at-risk', + title: 'Why may my multisig wallet funds be at risk?', + }, { type: 'category', category: 'self-hosting', diff --git a/frontend/src/app/docs/api-docs/api-docs.component.html b/frontend/src/app/docs/api-docs/api-docs.component.html index 1eeb01f87..7be67000f 100644 --- a/frontend/src/app/docs/api-docs/api-docs.component.html +++ b/frontend/src/app/docs/api-docs/api-docs.component.html @@ -547,3 +547,9 @@

If you're getting errors when doing address lookups, it's probably because of your Electrum server backend.

Mempool uses an Electrum server to do address lookups. There are several implementations of the Electrum server protocol, and Mempool can use any of them, but the implementation you use affects performance:

  1. romanz/electrs. This is a common choice for its low resource requirements, and most full-node distros use it. But while this implementation works great for basic queries, it will struggle with heavier ones (e.g. looking up addresses with many transactions)—especially when running on low-power hardware like a Raspberry Pi.
  2. Fulcrum. Fulcrum requires more resources than romanz/electrs but it can still run on a Raspberry Pi, and it handles heavy queries much more efficiently. If you're having issues with romanz/electrs, Fulcrum is worth a try.
  3. mempool/electrs. If you have stronger hardware, you could consider running mempool/electrs, the backend that powers mempool.space. It's a fork of Blockstream's Esplora, which is in turn a fork of romanz/electrs, intended for maximum performance and larger-scale deployments.
 + + +

If a transaction reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a Coldcard with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds may be at elevated risk of theft while unconfirmed.

+

If an address has been used and reveals a multisig script (threshold + public keys) and enough of the keys to meet the threshold were generated on a Coldcard with the pre-fix firmware (or otherwise weak entropy) and lack sufficient extra entropy/passphrase, the funds in the address are vulnerable.

+

See Coinkite’s advisory.

+ From dd202ac1b3f577b3336b02200fae95038bff2e03 Mon Sep 17 00:00:00 2001 From: rodribp Date: Wed, 12 Aug 2026 13:03:26 -0600 Subject: [PATCH 4/4] style: add emoji, shorten phrases and default hyperlink style --- frontend/src/app/components/address/address.component.html | 2 +- frontend/src/app/components/address/address.component.scss | 3 --- .../transactions-list/transactions-list.component.html | 4 ++-- .../transactions-list/transactions-list.component.scss | 5 +---- 4 files changed, 4 insertions(+), 10 deletions(-) diff --git a/frontend/src/app/components/address/address.component.html b/frontend/src/app/components/address/address.component.html index 7c210c003..f477e4dd7 100644 --- a/frontend/src/app/components/address/address.component.html +++ b/frontend/src/app/components/address/address.component.html @@ -267,7 +267,7 @@ diff --git a/frontend/src/app/components/address/address.component.scss b/frontend/src/app/components/address/address.component.scss index 499a4c85f..b2afeca9e 100644 --- a/frontend/src/app/components/address/address.component.scss +++ b/frontend/src/app/components/address/address.component.scss @@ -141,9 +141,6 @@ h1 { position: relative; background-color: #b71c1c; border-color: #b71c1c; - a { - color: #fff; - } } .btn-close:hover, diff --git a/frontend/src/app/components/transactions-list/transactions-list.component.html b/frontend/src/app/components/transactions-list/transactions-list.component.html index 542e740b7..1998ded2e 100644 --- a/frontend/src/app/components/transactions-list/transactions-list.component.html +++ b/frontend/src/app/components/transactions-list/transactions-list.component.html @@ -22,8 +22,8 @@ } @if (showColdcardWarning) { -