Firmware monorepo for Trezor One, Model T, and Safe devices.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61298 seen115 candidatesCompleteFeb 6 → Jun 6775 seen58 candidatesCompleteJun 6 → Jul 6217 seen13 candidatesCompleteJul 6 → Aug 5360 seen54 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 0 minutes ago
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PI…
1dbc2c3cby Michal Kazda+22−422 filesThis commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of p…
4a9cf168by cepetr+335−3112 filesThis commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellma…
429a283dby M1nd3r+45−74 filesThis commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix;…
d434a636by Jakub Janků+1−11 fileThis commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that fut…
7b58e75aby Jakub Janků+55−018 filesThis commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type c…
1cc940a4by cepetr+162−15247 filesThis commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-…
65402aecby Michal Kazda+2−103 filesThis commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior cha…
7ce6887fby Michal Kazda+5−184 filesThis commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …
dc937ba2by tychovrahe+81−711 fileThis commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…
caab7d9eby tychovrahe+772−4834 filesThis commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…
1436fbc6by cepetr+2−158 filesThis commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…
e231cc94by obrusvit+50−502 filesThis commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts …
6be32440by cepetr+48−32025 filesThis commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability be…
890aca93by cepetr+13−14 filesThis commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6dc781c2by M1nd3r+1202−203250 filesThis commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no securit…
6d69df16by Michal Kazda+20279−2023911 filesThis is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
162ed3a2by Michal Kazda+12−125 filesThis commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
a56f8c3dby Roman Zeyde+0−22 filesThis commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryp…
739c2968by Michal Kazda+19332−193364 filesThis commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant chan…
c66f6f4dby Michal Kazda+51−7413 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
7ce6887f · Sep 21, 2026 · 4 filesInformational 15refactor(core): merge passphrase__hidden_wallet into passphrase__wallet
[no changelog]
This commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior change.
bbda5c8c · Sep 18, 2026 · 1 fileTriage 0fix(rust/micropython): improve error handling when creating StrBuffer
[no changelog]
44cb9362 · Sep 18, 2026 · 1 fileTriage 0chore(core): update fixtures
[no changelog]
3893c0b8 · Sep 18, 2026 · 1 fileTriage 0feat(core): skip None and [] values in dump_protobuf
This significantly shortens the output for protobuf messages that
model tagged unions (see, e.g., StellarSCVal).
[no changelog]
ae5b1fed · Sep 18, 2026 · 1 fileTriage 0fix(core): do not disguise log errors as decode errors
[no changelog]
dc937ba2 · Sep 18, 2026 · 1 fileLow 45fix(core/bootloader): keep the full block length for block-0 retries
Block 0 is the only block fetched in two requests: an initial
IMAGE_INIT_CHUNK_SIZE prefetch so the headers can be validated, then the
remainder. `chunk_requested` was serving three roles at once -- request size,
expected buffer fill, and the amount still owed on `remaining` -- and after the
header prefetch it holds only the remainder.
A retry then asked for that remainder from offset 0. The size check compared
`chunk_size` against `chunk_requested + read_offset`, i.e. the remainder against
itself, so it passed and `on_chunk` received a truncated block: the first
`chunk_limit - IMAGE_INIT_CHUNK_SIZE` bytes sitting at buffer offset 0. The hash
then necessarily mismatched, so the retry budget burned down and the upload
aborted. Block-0 retries could never succeed -- on T3W1 that is a 256 KB block,
where a transient BLE error is most likely.
Replace `chunk_requested` with `chunk_expected`: the bytes the buffer must hold
for the chunk to be complete, i.e. the whole block. It is the only field of its
kind left -- every request is derived from it, `remaining` is decremented by what
actually arrived, and `read_offset` goes back to being purely a buffer write
offset. The retry re-fetches the whole block from its start, and the size check
compares against what the buffer must actually hold.
No behavioural change on the success path: the bytes asked for at each request
site are the same as before, and what the old check computed is exactly what
`chunk_expected` now holds.
Alongside, in the same code: the image-size validation becomes an early guard in
`run_image_upload`, which is what guarantees a full init chunk to prefetch;
`confirmed` folds into `headers_parsed`, both having been set at the same point;
and the result dispatch becomes a switch.
The same bug is in wf_firmware_update.c on main; this fix is written against the
extracted engine but applies there unchanged.
[no changelog]
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the bootloader tried to retry, it accidentally asked for only the leftover remainder but placed it at the start of the buffer. That produced a corrupted block, the hash check failed, every retry failed, and the firmware update aborted. The fix makes retries request the whole first block again from the beginning. There is no evidence this bug was exploitable by an attacker; it appears to be a reliability defect that could brick or stall legitimate updates, especially over Bluetooth on the T3W1 model.
caab7d9e · Sep 18, 2026 · 4 filesInformational 12refactor(core/bootloader): separate image upload and image checks
[no changelog]
This commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c, while keeping the firmware-specific checks (signatures, versions, user confirmation, per-chunk hash checks) in wf_firmware_update.c. There is no direct evidence in the diff that this change fixes or introduces a security vulnerability; it appears to be a structural refactor to make the upload code reusable for other image types in the future.
1436fbc6 · Sep 18, 2026 · 8 filesInformational 15chore(core): remove unused trezor_lib/ui feature
[no changelog]
This commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no security-relevant change to runtime behavior, no bug fix, and no vulnerability patch.
e231cc94 · Sep 17, 2026 · 2 filesLow 27fix(core/caesar): change confirm middle button
[no changelog]
This commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interaction for one specific screen (EIP-7702 authorizations) and updates the corresponding visual test snapshots. There is no direct evidence in the commit that this fixes a security vulnerability, but it could slightly reduce the chance of an accidental or coerced approval if the hold-to-confirm behavior was considered too easy to bypass or too confusing.
6901b718 · Sep 17, 2026 · 1 fileTriage 0ci: run xtask/xbuild tests and clippy
[no changelog]
6be32440 · Sep 17, 2026 · 25 filesInformational 15refactor(core): merge firmware and unix cargo packages
[no changelog]
This commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts accordingly. There is no user-facing change, no bug fix, and no security-relevant behavior change visible in the diff.
890aca93 · Sep 17, 2026 · 4 filesInformational 15chore(core): test aes gcm only if enabled
[no changelog]
This commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability being patched.
88a00ea8 · Sep 17, 2026 · 1 fileTriage 0chore(tests): clean input flows
- Removed unnecessary constructors.
- Widened constructor annotations - added `DebugSession`.
6dc781c2 · Sep 17, 2026 · 250 filesInformational 15 chore(python, tests): add and update GNU licence headers
- Follow-up to: https://github.com/trezor/trezor-firmware/pull/5471.
[no changelog]
This commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6d69df16 · Sep 17, 2026 · 11 filesInformational 15refactor(core): move the multisig XPUB title into a translation template
[no changelog]
This commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no security change.
162ed3a2 · Sep 17, 2026 · 5 filesInformational 15refactor(core): render translated strings verbatim in layouts
- en.json adapted accordingly
[no changelog]
This is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
a56f8c3d · Sep 17, 2026 · 2 filesInformational 15chore(core/bolt): remove unneeded `use` statements
[no changelog]
This commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
fd31ca06 · Sep 17, 2026 · 1 fileTriage 0chore(core): update fixtures
[no changelog]
739c2968 · Sep 17, 2026 · 4 filesInformational 18fix(core): add missing colon in Tron
[no changelog]
This commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryptographic operations, fund safety, or device security.
c66f6f4d · Sep 17, 2026 · 13 filesInformational 15fix(core): combine path/account with labels
[no changelog]
This commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant change visible in the code.
c18515c1 · Sep 17, 2026 · 1 fileTriage 0chore(core/embed/rust): use `as_slice()` instead of `as_ref()`
Since `rust-bitcoin` defines `impl AsRef<PushBytes> for [u8; $len]`[^1],
the existing code fails with:
```
error[E0282]: type annotations needed
--> rust/src/translations/obj.rs:65:53
|
65 | Qstr::MP_QSTR_data_hash => header.data_hash.as_ref().try_into()?,
<snip>
but trait `AsRef<miniscript::bitcoin::script::PushBytes>` is implemented for it
--> /home/rzeyde/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bitcoin-0.32.102/src/blockdata/script/push_bytes.rs:156:17
|
156 | impl AsRef<PushBytes> for [u8; $len] {
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...
184 | / from_array! {
185 | | 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24,
186 | | 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47,
187 | | 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,
188 | | 71, 72, 73, 74, 75, 76
189 | | }
| |_____- in this macro invocation
= help: for that trait implementation, expected `miniscript::bitcoin::script::PushBytes`, found `[&u8]`
= note: this error originates in the macro `from_array` (in Nightly builds, run with -Z macro-backtrace for more info)
```
[no changelog]
[^1]: https://github.com/rust-bitcoin/rust-bitcoin/blob/1cbf4bd62ea99c558c6d8ef794edbd984a2a4684/primitives/src/script/push_bytes.rs#L194
93bd25fa · Sep 16, 2026 · 8 filesInformational 18build(core): exclude `FirmwareUI::confirm_fido()` in BTC-only builds
[no changelog]
This commit is a build cleanup, not a security fix. It makes sure the FIDO (WebAuthn/passwordless login) confirmation screen is only compiled into the universal firmware that supports altcoins and FIDO, and is left out of the smaller Bitcoin-only firmware build. Previously the code was included in all builds but returned a 'not implemented' error on Bitcoin-only devices. The change reduces unused code and build size; it does not patch a vulnerability or change runtime behavior in a security-relevant way.
e7ed8202 · Sep 16, 2026 · 1 fileTriage 0ci: bot-tropic-emulator: fix condition
Why it was queued5641919d · Sep 16, 2026 · 1 fileTriage 0test(stellar): update UI fixtures
[no changelog]
c623d7ce · Sep 16, 2026 · 1 fileTriage 0test(stellar): update UI fixtures
Regenerated after rebasing `secfix/26.09` over `main`.
[no changelog]