Shrike
Docs
Hardware wallet firmware
A hardware wallet is what actually signs your transactions. For a signature to carry the new protection, the device has to know how to produce it, and no manufacturer ships firmware that does yet.
Unofficial builds exist for Coldcard, SeedSigner and Trezor, listed below. Flashing one is not a small decision, so read the warning first.
You may well not need to. An unmarked device still signs perfectly well, and in a multisig wallet one upgraded signer is enough to protect the whole transaction, so a single device can cover a wallet whose others stay on stock firmware.
In the wallet, ticking Replay protection on a keystore is how you tell Shrike that its device can sign the new way. Shrike cannot detect it, because nothing the device reports says which firmware it runs.
These are unofficial, unaudited builds, and none of them are affiliated with or endorsed by the manufacturers. Flashing one replaces the software that holds your keys and signs your transactions.
It will void your manufacturer warranty. It can brick the device. A build that is wrong, or tampered with in transit, can sign away your coins. Back up your seed and verify it restores elsewhere before you start, and verify the signed SHA256SUMS against the release key before flashing rather than after.
Nobody has to flash anything. An unmarked device still signs, with the hash type it can produce, and the send screen reports exactly what the transaction got. Marking one signer in a multisig quorum is enough for the whole transaction to opt in, so a single upgraded device can cover a wallet whose other signers stay on stock firmware.
Available builds
| Device | Build | Notes |
|---|---|---|
| SeedSigner | seedsigner | Shows the signature hash type on screen, so you can confirm what it signed. |
| Trezor Model One, Model T, Safe 3, Safe 5, Safe 7 | trezor-firmware | Bitcoin-only. Model One takes the T1B1 build at 1.14.2; Model T (T2T1), Safe 3 (T3B1), Safe 5 (T3T1) and Safe 7 (T3W1) take 2.12.5. Match the model code in the filename to your device. |
| Coldcard Mk4, Mk5, Q | cc-firmware | Mk4 and Mk5 take the -mk-coldcard.dfu file, Q takes -q1-coldcard.dfu. |
Earlier releases in these repositories have been withdrawn and superseded. Take the newest one rather than an older tag, and read its notes: they say what changed and whether an earlier build should be replaced.
Keep the firmware and the wallet current together. The opt-in is negotiated through a capability the device reports, so a mismatched pair refuses to opt in rather than signing without the protection. If a marked device stops opting in after you update one of them, update the other.
Verifying a build
Each release carries a SHA256SUMS signed with the same key as the Shrike releases. Verify before flashing:
gpg --import privkeyio-signing-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMSFingerprint A47D 99B6 DB0D 715D 40C5 9A20 23AE 8A8E A7E2 4E38, Kyle Santiago <kyle@privkey.io>. A signature that does not verify means you do not flash it.
After flashing
Nothing the device reports tells Shrike what firmware it is running, so the wallet still will not detect the change. Mark the keystore yourself in the wallet settings, then check the send screen on the next transaction to confirm it actually opted in. See replay protection for what the marks mean in a multisig quorum.