Faraday 0.1.8

Faraday 0.1.8, a pre-release: one outside AI-assisted audit (by MrHodlX, on GitHub issues #4 and #5 and in three private advisories) has been answered, and its findings are fixed in this release; no second builder has reproduced the builds. Use at your own risk.

A stick or card needs 256 MB or more. The layout is the one of 0.1.7: a 64 MiB boot partition and a 128 MiB data partition. Faraday's boot file takes about 14 MB of the stick's boot partition (about 16 MB of the Pi card's); the rest is room for later versions, and the data partition holds your files. A stick made with 0.1.6 or 0.1.7 keeps its files with the Starter's Replace Faraday, keep data. Faraday no longer upgrades a stick itself (see Removed). A stick made with an earlier release has a 48 MB boot partition, and the Starter refuses it: copy its files off first, then write 0.1.8 whole. A Pi card is written whole.

Faraday Starter

• Faraday-Starter-0.1.8-Windows.exe: Faraday Starter for Windows (x86-64). It is not code-signed: Windows shows "Windows protected your PC" the first time; check it against SHA256SUMS, then More info, Run anyway.
• Faraday-Starter-0.1.8-Linux.tar.gz: Faraday Starter for Linux (x86-64), one file inside, Faraday-Starter-0.1.8-Linux. Ubuntu 20.04 and later, Debian 11 and later, Fedora 32 and later, Arch.

Faraday Starter makes a Faraday stick or a Raspberry Pi card and checks what it wrote, then shows how to start this computer from the stick, step by step for its maker, and how to set it back. It also moves files to and from the device by QR code and prints blank templates for copying seeds by hand. It carries this release's images; no download happens later. Open Faraday Demo on its Home runs Faraday Demo (until 0.1.7, Faraday Desktop) inside the Starter's own window, for trying Faraday on an online computer; Back returns to Home and ends the session. Faraday Demo is no longer installed on its own: the Starter's Install and Uninstall remove a Faraday Desktop or Faraday Demo an earlier Starter installed. Faraday Demo opens in Practice (until 0.1.7, Demo); Testnet, Signet and Regtest are on its mode pill. It has no mainnet. Never type a seed that holds real bitcoin into it. Its sticks are folders in faraday-sticks in the home folder (BOOTSTICK is the boot stick, empty at first).

Other downloads

• faraday-stick-0.1.8-x86_64-uefi.img.xz: the USB stick image for a PC (UEFI, x86-64)
• faraday-pi-0.1.8-pi3-waveshare-28dpi.img.xz: the microSD card image for a Raspberry Pi 3 with a 2.8-inch Waveshare panel
• faraday-0.1.8-BOOTX64.EFI (new): the stick's boot program, EFI/BOOT/BOOTX64.EFI byte for byte, unsigned. It is for a person with their own Secure Boot keys: with SHA256SUMS and SHA256SUMS.asc beside it, Faraday signs it in Secure Boot keys (only a release's own boot program, at least as new as the Faraday signing it, listed in sums signed by the release key), and the Starter writes the signed file to a stick (What to write, Boot file, One I signed). README, "With Secure Boot".
• SHA256SUMS, SHA256SUMS.asc: the files' SHA-256 sums and the commit they were built from, with a detached signature. Each .img.xz is listed with the .img inside it, and the .tar.gz with the file inside it.
• v0.1.8.tag, v0.1.8.tag.asc: the release tag's text and its signature

Raspberry Pi Imager and balenaEtcher take an .img.xz as it is; other tools need it decompressed (xz -d on Linux, 7-Zip on Windows).

New since 0.1.7

Security fixes from the audit

• FROST signing across places (critical): the carry file held the other signers' secret nonces, from which their shares could be worked out. FROST was already compiled out of the app in 0.1.7; it is now removed from the repository until its standards are published, and returns only as a new implementation in which each signer draws its own nonce.
• Multisig change (critical): with no wallet registered, an output whose script merely held one of the person's keys was shown as change and left out of what is sent. Multisig change is now verified only against a registered wallet; otherwise it is shown as a payment.
• A tr() wallet whose internal key is not BIP 341's unspendable point (high) read as a script-only multisig, though that key can spend everything alone. The wallet now states who can spend by its key path; a key that is not one of the wallet's is a Danger line naming it, the wallet is added only after a hold, and every spend from it repeats the warning.
• Upgrade a Faraday stick (high) trusted a source partition by its release string and size. It is removed: Faraday writes no boot partition, and a stick is upgraded by the Starter, which checks the image against the release's manifest.
• Silent payments (high): a wallet record's scan key was never checked, so a tampered record could show an address whose payments only someone else can find. Both keys are now checked against the loaded key at the record's account, the address is derived from the key, and a record that does not match is refused.
• Finalized inputs (high): an input the coordinator had finalized skipped the check on SegWit v0 amounts, which let two rounds of signing pay a fee far above the one shown. A finalized input is now held to the same rule: with more than one input, a PSBT holding a SegWit v0 input whose amount cannot be checked is not signed, finalized or not.
• QR codes of secrets (high): the codes drawn for a secret stayed in memory after the view closed. The view, the encoders and every copy of the text and codes are wiped when dropped.
• SIGHASH_SINGLE (rated high on review): an input asking SINGLE with no output of its index is refused (such a signature commits to no output); SINGLE with its output, and NONE, are Dangers, which Faraday does not sign.
• Wallet names (rated high on review): a name read from a file could run over several lines into a printed sheet. A wallet's name is one line wherever it comes from, and a sheet that names a field twice is refused.
• Split backup sheets and the Coldcard multisig config (high, found tracing the audit): they were offered for wallet shapes they cannot restore. They are offered only for wallets they restore, and Faraday rebuilds the wallet from them and compares its first addresses before anything is written.
• Most of the mediums and lows are fixed, and a few are answered by design; the verdict on each finding is in Faraday's replies: #4 (comment) and #5 (comment) (all audits and replies: https://faradayoffline.app/audits/). Advisories: GHSA-7h4m-p8qx-pxrf, GHSA-w52w-c7x4-8pw5, GHSA-vxpw-8g7c-8qmr.

No way past a check

• A check that keeps keys or money safe has no way past it unless a real case needs one, and then the way past is a hold that names the case (docs/STANDARDS.md §0). Signing takes no force: the only danger that can be accepted is a high or absurd fee (for a child paying for its parent, a batch or a consolidation), by a hold that names it.
• A transaction whose timelock no path of the person's keys meets, and a derivation that does not give the input's key, are refused at Review, and Review stops at a refusal and says what to do. Change that cannot be verified is shown as a payment. An unknown fee reads Not known.
• Continue anyway for an attached TV or KVM (on the stick and in the Starter), and the Starter's keep-data write over a stick holding a newer release, take a hold naming their case.

Multisig

• An input spending a script of several keys that names one of the person's keys is signed only for a registered wallet that holds that key.
• A wallet can be registered from the PSBT's global xpubs with one hold, showing its threshold and each cosigner, only when every key under the person's fingerprint is the person's own and the keys give every input's and change output's script; sorted and listed keys are told apart, or the person chooses. Origins of more than 16 steps are refused.
• Only the exact multisig script form is read as multisig, and a cosigner key is the person's only where a loaded key derives it at the stated path.

Spending

• A finalized wsh or sh(wsh) miniscript input carries the smaller of its satisfactions by the real size of its signatures, and the first branch the script names where two weigh the same; a witness that differs from miniscript's is taken only once its interpreter accepts it.
• A taproot leaf that checks a key by hash is signed and left for the coordinator to finalize; a miniscript that is not sane (a spend needing no signature, mixed timelocks, a key named twice) is refused, as Bitcoin Core refuses it.
• A timelock is met only as consensus checks it (BIP 65, 68, 112): a version 1 transaction meets no relative wait.
• A previous transaction states an input's spent output only when its id is the input's and it agrees with the witness output.
• A MuSig2 pass shares its nonces before it signs, so a signature made in the same pass stays on the input.
• Spend's panel says change is verified only when every change output is ("2 of 3 unverified"). The Spend tab marks Check done only once the money was checked. Decode takes the amounts going in only from a PSBT of exactly this transaction. Collect refuses a cosigner's signature under another sighash.
• A PSBT input carrying threshold records is blocked and not signed, saying why.

Material 3

• Text follows Material 3's type scale in Faraday, the Starter and Faraday Demo: eleven roles from Headline M to Label S, buttons 40 dp, outlined fields 56 dp, list items at 56, 72 and 88 dp.
• Settings › Appearance has Text size, Standard or Large, kept on the stick like the theme.
• Faraday's mark is redrawn in golden proportions; the app icons draw it in Cobalt Light's primary, and the boot logo is Cobalt Light: the whole screen on the Pi, on a PC a square in the golden ratio around the mark and its name.
• Scan is a floating action button in Material's primary colour style.
• A compact window's top app bar is Material's small top app bar (64 dp); on the Pi, Learn, Show keyboard and Show sheets go into a ⋮ menu where they do not fit.
• On a small panel the field being typed in, with its label and the line under it, stays above the on-screen keyboard.
• The camera's viewfinder outlines a found code in the theme's warning colour and a read one in its OK colour.
• Settings' theme chips are drawn in their own theme's colours; toasts are Material's snackbar.
• Settings is every card on one page from medium windows up and a list of its sections on compact ones; with Guided on, each card carries a short explainer.
• An open vault's items and Codes can be searched by title (Material's search bar; the search view on compact windows).
• Wide windows: from 1600 dp Learn opens as a pane beside the page; a chart node's sheet is a side sheet beside the chart; the backup board's places stand in columns; Tools, Transfer and a stick visit are centred and the catalogue takes more tiles to a row.
• On the Pi panel nothing is cut off on any screen, step, tab or sheet, in any mode (tested on every screen).

Keys, vaults and backups

• Explore shows a key's secrets behind eyes, on the stick and on mainnet: its words and passphrase, or its seed and codex32 strings; its root and account extended private keys; each address's private key as WIF. Nothing secret shows until an eye is pressed, and all of it is dropped on leaving Explore, at the idle warning and at a lock.
• In Vault contents a secret shows at a press on its eye and hides at the next, never by a hold. + Bitcoin key saves any loaded key, a codex32 key included.
• Saving a secret as a plain file (seed words, a SeedQR, a codex32 string, a private key, a passphrase, a secret note) asks for a hold on "Save without encryption?", with Put it in a vault where a vault can take it.
• Zeroing a stick's free space or its whole files partition takes a hold.
• The boot import reads only the boot stick's file names and sizes until Import, then only the ticked files.
• New key: the randomness sources stand on the Generator card with none chosen and a Skip; a length is one press of a count; the word lists' search finds a word by its number, bits or dice.
• Make a new wallet takes a stick with one press, unlocks nothing until every stick is read, opens Create a vault by itself where only a new vault fits, and ends at Check with Back up wallet. Its Keys card lists a key file it cannot take, disabled, with the reason.
• A descriptor scanned while Create waits for a cosigner's key fills the waiting slot where it names one key that can be it; a key fills a slot only with its origin at the kind's derivation.
• Restore and codex32 never combine shares of different seeds or wallets, and Restore matches a seed to a slot by its whole key.
• A vault holds exactly the plan's codex32 strings of the plan's set. After a power-on, the backup round types a codex32 share it no longer holds in place, refusing a share of another set, index or seed.
• A backup plan accepted at the lock can always be written: the public files never share a stick with a secret file.
• A vault's changes are never dropped silently: entries that do not fit its slot add nothing and say so, and a changed vault that cannot be sealed stays open at the lock.
• A passphrase field refuses a character outside printable ASCII. A computer that does not say what memory it has free makes and unlocks only vaults of Light's memory, and says why.
• Secrets are wiped on every return, errors included, in AEZ, SLIP-39, MuSig2, codex32, the extended key reader, the signing nonce seed, the file service, the entry field and New key's SLIP-39 deal; a scan's parts and a QR code read from a frame are wiped too.

Faraday Demo (until 0.1.7, Faraday Desktop)

• Its Demo mode is Practice; the pill reads "Practice · Testnet".
• It is laid out as the device, with a strip at its foot holding the sticks, Samples, Size (the preview sizes, from the Pi panel to a full monitor) and the current screen's Practice aids. The strip takes the opposite of the app's theme and has 48 dp controls.
• Paste words takes a whole seed phrase into the words, in Practice and on the test networks; it is checked as typed words are. The stick and the Pi have no clipboard.
• Pointer and keys is a source of one's own randomness on Faraday Demo, mixed in and credited with nothing.
• At rest it draws nothing; it scrolls under a finger and presses once per tap.
• A theme chosen in it is the Starter's for the rest of the session; at start Light or Dark follows the system.

Faraday Starter

• Faraday Demo runs inside the Starter's window (Linux and Windows).
• For a stick for a PC or an Intel Mac, What to write offers Boot file: the release's (unsigned) or One I signed. A signed file is taken only when it is this release's boot program with one signature that holds; the Starter shows the signing certificate's name and SHA-256 and writes the release's own bytes with that signature.
• Upgrading a stick is the Starter's: Replace Faraday, keep data checks the image against the release's manifest.
• On Linux it refuses a disk mounted under /mnt, a disk with a device built on it (LVM, RAID, an opened encrypted volume) and a disk whose holders it cannot read; it reads the disk again after opening it.
• A key sheet is written only into a fresh folder only the person can open, and the start-up sweep touches only the Starter's own files.
• A page whose content changes in place keeps what was last pressed where it was.

Removed

• FROST and threshold wallets, from the repository (above). A threshold record is not a wallet, and a carry file opens no spend.
• Settings › Upgrade a Faraday stick and the boot copier (above); Settings has no Sticks section.
• codex32 strings for a key of words: codex32 is a backup only of a key whose secret is a codex32 set already. A key with a set keeps Check my copy, Add a share, Replace a share and Rotate the set.
• Force on signing (above).

Cross-check, tests and builds

• just crosscheck gains three areas: sign (signing and finalizing PSBTs end to end against BIP-174's vectors, Core-built spends and a random corpus of every script type, each signature and transaction compared byte for byte), taproot (output keys and control blocks against BIP-341's vectors and Core's builder over random trees) and miniscript (Core's vectors and random wallets against python-bip380). The frost area went with FROST: 26 areas.
• Fuzzing adds pe_transplant, pgp_verify, release_sums, pgp_paperkey and pgp_restore; the boot copier's and the carry file's targets went with them: 40 targets.
• Dependencies: crypto-bigint 0.7.10 and ctutils 0.4.6 in place of 0.7.6 and 0.4.5, which upstream yanked for a breaking change, not a flaw. In cargo vet, a crate read by an AI counts as no audit: the sixteen crates read so are exemptions, each docs/deps/ page saying it is not reviewed by a human.
• The image build checks the kernel's option names and needs a clean Buildroot tree.
• A release publishes its boot program, faraday-X.Y.Z-BOOTX64.EFI, listed in SHA256SUMS.

Checks before this release

• just crosscheck --fresh at the version commit 73984cb, seed a162961a3fd9aabbb48f42411c147dcb, ten times the random cases, 26 areas (listed in tools/crosscheck/README.md): every answer agreed, about 2.45 million answers, the known differences listed in tools/crosscheck/README.md among them (946.7 s).
• Before it, a fresh run on the version commit's first form (seed 4fde5465b6aeebd4007b9500d6cbd4f7) agreed in every area but one sign case: an or_b miniscript input signed by both keys, where Faraday carried one key's 72-byte signature and python-bip380 the other key's 71-byte one. Both witnesses are valid; Faraday now carries the smaller (commit 5977292), and the sign area then agreed at ten times the cases on that seed and on two new ones.
• An earlier fresh run was stopped when the tx area's reference, Bitcoin Core's test framework, spent hours rebuilding a malformed transaction's witness; the harness now refuses such a transaction at once, with the same answer (commit bafcc88).
• just fuzz-release at commit fc44cf0 (rustc 1.101.0-nightly 2026-10-12, cargo-fuzz 0.13.2, starting from the committed seeds and the corpora kept from earlier runs): 40 targets, 600 s each, no crashes.
• The finalizer change above came after that run, so psbt_parse, the target that reaches it, was fuzzed again at the version commit 73984cb: 600 s, eight workers, about 23.3 million runs, no crashes.
• The corpora both runs grew, minimized, are at https://github.com/bitcoinpasada/faraday-fuzz-corpus, commit 699549c, tag v0.1.8.