COLDCARD vulnerability may stem from compiler bypass handling

Odaily Planet Daily News Bitcoin News posted on the X platform, stating that a new technical analysis by Core-Lightning developer ddustin shows that the 2021 COLDCARD vulnerability may have originated when developers attempted to connect wallets through Python code, MicroPython's C code, and the STM32 hardware random number generator. The custom code appears to conflict with MicroPython's existing implementation, potentially triggering compiler errors. Evidence shows that developers subsequently set MICROPY_HW_ENABLE_RNG to 0, allowing the firmware to compile successfully. This change brought unexpected consequences: when users create new wallets, the firmware no longer uses the hardware random number generator but instead falls back to MicroPython's weaker Yasmarang software random number generator. The commit message left by the developers was only "runs." The analysis states that this serves as a reminder for developers not to release security-critical code they do not fully understand, especially when it protects billions of dollars in Bitcoin.