Frostsnap 0.4.0

Original release notes

Firmware digest (deterministic build): 037c345c9db9866d30e219ae56de5efe3905a4050a82df362590d5017e709df0

Stay Frosty.

Security

Two security issues are fixed in this release. Each has a user bulletin and a technical report. Update your app and device firmware to v0.4.0.

A malicious app could trick your devices into signing a hidden output. A signing request could mark an output as belonging to your own wallet; the device left such outputs off its confirmation screen and never checked the claim. Reachable only by software talking to your device in place of the Frostsnap app. Found and fixed 3 August 2026 (#525), hardened 19 August (#540, #546) -- report
Change addresses beyond the recovery range. Change from a payment could land past the range a wallet recovery scans, so a restored wallet might not find every coin. Your bitcoin is safe on-chain; v0.4.0 finds out-of-reach coins and offers to bring them back within range. Reported by a user 15 August 2026, fixed the next day (#542, #543), remedies through 20 August (#545, #550) -- report

Highlights

Your balance and what you can spend now agree. Coins stranded past an address gap in the keychain are detected, made spendable, and consolidated.
Firmware only moves forward. Devices reject older firmware and show their version on standby; the app offers the upgrade when a connected device is behind.
Informative Electrum errors. A failed connection reports the reason instead of echoing the URL you typed.
Fewer crashes. A malformed QR, a PSBT that will not parse, an output with no address form, or a signature share arriving for a session the app has already finished no longer crashes anything.

What's Changed

Security fixes

[core] Check output owners in sign task validation by @LLFourn in https://github.com/frostsnap/frostsnap/pull/525
Bound the derivation paths a sign task may present as ours by @LLFourn in https://github.com/frostsnap/frostsnap/pull/540
Device sign prompt discloses self-spend outputs, and both surfaces name them by @LLFourn in https://github.com/frostsnap/frostsnap/pull/546
Make the fee display pure: plan is a value, commit is the only mutation by @LLFourn in https://github.com/frostsnap/frostsnap/pull/542
Balance and Send Max agree: persisted reveals and a 50-script lookahead by @LLFourn in https://github.com/frostsnap/frostsnap/pull/543
Change reservations are a computed view of live signing sessions, not wallet state by @LLFourn in https://github.com/frostsnap/frostsnap/pull/544
Force-spend coins stranded past a risky gap by @LLFourn in https://github.com/frostsnap/frostsnap/pull/545
Let users consolidate coins a restore would miss, and stop losing them to a narrow window by @LLFourn in https://github.com/frostsnap/frostsnap/pull/550

New features

Block firmware downgrades on the device by @LLFourn in https://github.com/frostsnap/frostsnap/pull/529
[widgets,device] Show the firmware version on the standby screens by @LLFourn in https://github.com/frostsnap/frostsnap/pull/562
[app] Prompt to upgrade a connected device's firmware by @LLFourn in https://github.com/frostsnap/frostsnap/pull/541
Device naming improvements by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/502
Unique device names and no unauthenticated device renaming by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/505
Add warning dialog for 1-of-N thresholds by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/504
Add descriptor checksum generation by @7-falseparfait in https://github.com/frostsnap/frostsnap/pull/520
Verify secure-boot signer at build time and in verify-firmware CLI (supersedes #494, #495) by @LLFourn in https://github.com/frostsnap/frostsnap/pull/498
Add SECURITY.md by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/531

Reliability fixes

[coord] Test that a synced coin stays spendable after a restart by @LLFourn in https://github.com/frostsnap/frostsnap/pull/547
[coord,app] Count confirmations in Rust, from the tip the snapshot was made at by @LLFourn in https://github.com/frostsnap/frostsnap/pull/589
Identify transaction recipients this wallet derives as our own by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/586
Fix transaction list ordering by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/516
Fix searching for internal address by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/572
[coord] Fix inverted revealed check in address_info by @LLFourn in https://github.com/frostsnap/frostsnap/pull/564
An output with no address is a fact, not a panic by @LLFourn in https://github.com/frostsnap/frostsnap/pull/567
Read PSBTs and place signatures using the template, not the wallet index by @LLFourn in https://github.com/frostsnap/frostsnap/pull/560
Say why a PSBT wouldn't parse by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/570
Don't panic on a QR that isn't a PSBT by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/581
[coord] Don't panic on a signature share for an unknown session by @average-gary in https://github.com/frostsnap/frostsnap/pull/557
[coord] Keep Electrum error causes and the active server across disconnects by @LLFourn in https://github.com/frostsnap/frostsnap/pull/588
Electrum: fix disable/startup behavior + signet servers; refactor config to a watch subject by @LLFourn in https://github.com/frostsnap/frostsnap/pull/508
Don't double-apply lookahead to electrum subscriptions by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/515
Don't add TOFU certs to the PKI root store by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/571
[embedded] fix nonce index bug in AbSlot crash recovery by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/496
[app] Make the Android app key work on phones the strict spec locked out by @LLFourn in https://github.com/frostsnap/frostsnap/pull/533
Mac tabs and dmg path by @LLFourn in https://github.com/frostsnap/frostsnap/pull/493
[coordinator] Log nUSB read errors instead of discarding them by @LLFourn in https://github.com/frostsnap/frostsnap/pull/538
[app] Take the stranded-coins scan off the render thread by @LLFourn in https://github.com/frostsnap/frostsnap/pull/565

App UI polish

Centralize bottom safe-area handling (fix buttons under the Android nav bar) by @LLFourn in https://github.com/frostsnap/frostsnap/pull/507
[app] Improve startup error page by @LLFourn in https://github.com/frostsnap/frostsnap/pull/389
[app] Show a 'saving' state before the unplug prompt at keygen by @LLFourn in https://github.com/frostsnap/frostsnap/pull/514
Name the testnet version in the UI by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/528
App UI nits by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/580

Device / firmware UI

Draw the progress bar with our AA rounded rect so it can erase itself by @LLFourn in https://github.com/frostsnap/frostsnap/pull/536
[widgets] Settle hold progress before a touch flips holding by @LLFourn in https://github.com/frostsnap/frostsnap/pull/556

Internal

Enforce cargokit lockfile by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/491
frost_backup: rewrite recovery share-lookup with the ? operator by @LLFourn in https://github.com/frostsnap/frostsnap/pull/510
test(coord): fixed verifier time for TOFU fixture tests (fix Test-ordinary CI time-bomb) by @LLFourn in https://github.com/frostsnap/frostsnap/pull/519
Stabilize and unblock Frontier stack checks by @LLFourn in https://github.com/frostsnap/frostsnap/pull/532
Inline the revealed_index expects at their call sites by @LLFourn in https://github.com/frostsnap/frostsnap/pull/559
[coord] Fix master: the restart test still builds a bip32 path from a u32 by @LLFourn in https://github.com/frostsnap/frostsnap/pull/561
Fix master's two clippy failures from the 1.98 lint bump by @LLFourn in https://github.com/frostsnap/frostsnap/pull/573
[psbt] check_spk and Transaction::fee cleanup by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/575
Add v0.4.0 firmware and bump app version by @nickfarrow in https://github.com/frostsnap/frostsnap/pull/539

New Contributors

@7-falseparfait made their first contribution in https://github.com/frostsnap/frostsnap/pull/520
@average-gary made their first contribution in https://github.com/frostsnap/frostsnap/pull/557

Full Changelog: https://github.com/frostsnap/frostsnap/compare/v0.3.0...v0.4.0