We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit is a code cleanup with no security impact. It replaces repeated raw Ethereum address byte strings with named constants and adds debug-only assertions to verify those constants match the expected addresses. No behavior of the Tr…
b3cc4546by obrusvit+61−121 fileThis commit fixes a small logic bug in SeedSigner, a hardware-wallet-like signing device. The code was checking whether a seed's fingerprint string was empty, but it should have been checking whether the seed has a passphrase. The bug coul…
c52577a9by kdmukai+3−21 fileThis is an internal code cleanup in Trezor's Ethereum transaction signing. It changes how staking and yield-farming transactions hand off their user-confirmation step so the confirmation happens inside the same routine instead of being ret…
6c158b50by Roman Zeyde+1138−11434 filesThis is a tiny code cleanup in the Trezor firmware's user-interface layer. It removes an `assert` statement that checked the return value of a repaint request. There is no security-relevant change: the method still performs the same repain…
8a449f05by Roman Zeyde+1−21 fileThis commit only adds new automated tests for the bookkeeper feature, checking that it correctly records accounting events when Lightning channels are spliced in (adding funds) or spliced out (removing funds). It does not change any produc…
f5965b3aby enaples+239−01 fileThis commit only updates a single test file (tests/test_bookkeeper.py). It removes an experimental feature flag that is no longer needed, fixes Python style issues flagged by flake8, and replaces a hardcoded 5000-satoshi splice-out fee est…
906663a0by enaples+16−281 fileThis commit tightens validation in the hardware wallet's AES-GCM encryption code by rejecting initialization vectors (IVs) of length zero. Previously, a zero-length IV was silently accepted, which violates the NIST standard and can lead to…
e49753d6by Ondřej Vejpustek+9−21 fileThis commit only adds a new test to the Trezor firmware crypto test suite. It checks that multiplying certain special 'low-order' points on the Curve25519 curve by various secret scalars always produces an all-zero result. There is no chan…
1320b2b0by Ondřej Vejpustek+66−01 fileThis commit is purely a housekeeping style-tool change. It adds the wycheproof test-data submodule to a list of paths that the project's Python style checker should ignore. There is no change to wallet, cryptographic, or firmware code, and…
df89d627by Ondřej Vejpustek+2−11 fileThis commit only updates the project's cryptographic test suite to match a newer version of the Wycheproof test-vector submodule. It changes test data file names and field names (for example, 'keyDer' to 'publicKeyDer') and adds a safety c…
a56f7418by Ondřej Vejpustek+13−152 filesThis commit only adds and improves test code. It extends an existing test suite to check more cryptographic algorithms (AES-GCM, AES-CCM, HMAC, PBKDF2) using well-known public test vectors from Project Wycheproof. It also fixes a few small…
6bee661bby Ondřej Vejpustek+421−121 fileThis commit fixes a length-check bug in Trezor's Stellar cryptocurrency support. The device was measuring string length in characters (Unicode code points) instead of bytes. Because some characters use multiple bytes, a string could pass t…
888aa308by Jakub Janků+11−83 filesA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.