Firmware monorepo for Trezor One, Model T, and Safe devices.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61298 seen115 candidatesCompleteFeb 6 → Jun 6775 seen58 candidatesCompleteJun 6 → Jul 6217 seen13 candidatesCompleteJul 6 → Aug 5360 seen54 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 33 minutes ago
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PI…
1dbc2c3cby Michal Kazda+22−422 filesThis commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of p…
4a9cf168by cepetr+335−3112 filesThis commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellma…
429a283dby M1nd3r+45−74 filesThis commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix;…
d434a636by Jakub Janků+1−11 fileThis commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that fut…
7b58e75aby Jakub Janků+55−018 filesThis commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type c…
1cc940a4by cepetr+162−15247 filesThis commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-…
65402aecby Michal Kazda+2−103 filesThis commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior cha…
7ce6887fby Michal Kazda+5−184 filesThis commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …
dc937ba2by tychovrahe+81−711 fileThis commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…
caab7d9eby tychovrahe+772−4834 filesThis commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…
1436fbc6by cepetr+2−158 filesThis commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…
e231cc94by obrusvit+50−502 filesThis commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts …
6be32440by cepetr+48−32025 filesThis commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability be…
890aca93by cepetr+13−14 filesThis commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6dc781c2by M1nd3r+1202−203250 filesThis commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no securit…
6d69df16by Michal Kazda+20279−2023911 filesThis is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
162ed3a2by Michal Kazda+12−125 filesThis commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
a56f8c3dby Roman Zeyde+0−22 filesThis commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryp…
739c2968by Michal Kazda+19332−193364 filesThis commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant chan…
c66f6f4dby Michal Kazda+51−7413 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
3fc6592b · Sep 16, 2026 · 3 filesTriage 0feat(core/delizia): use Marquee in Footer
[no changelog]
541db60a · Sep 16, 2026 · 2 filesTriage 0chore(vendor): update `ts-tvl` to version 2.6
- Updated from version 2.5.
- Changelog: https://github.com/tropicsquare/ts-tvl/blob/public/CHANGELOG.md#26.
- Code changes: https://github.com/tropicsquare/ts-tvl/compare/2.5...2.6.
2fb12354 · Sep 15, 2026 · 2 filesTriage 0fix(core/bolt): mnemonic prompt
[no changelog]
18da22f8 · Sep 15, 2026 · 12 filesInformational 15chore: bump versions
$ tools/bump-version.py core 2.12.6
$ tools/bump-version.py core/embed/projects/secmon 1.0.15
$ tools/bump-version.py core/embed/projects/prodtest 0.3.10
wrote 357 error codes across 25 modules to /home/rzeyde/src/trezor-firmware/core/embed/projects/prodtest/error_codes.json
[no changelog]
This commit only updates version numbers and translation metadata. It changes no actual code, logic, or security behavior. There is no security issue here.
dc99b245 · Sep 15, 2026 · 1 fileTriage 0fix(core): reduce the allocated buffer size for translation blob upload
See https://github.com/trezor/trezor-firmware/issues/7888#issuecomment-5681062765.
Not a full fix for the underlying issue.
[no changelog]
9e244bab · Sep 15, 2026 · 1 fileTriage 0chore(core): remove unused USB config
remove the PRODTEST configuration. The PRODTEST constant was not defined so it was never used.
[no changelog]
16a1776a · Sep 14, 2026 · 1 fileTriage 0fix(core): include rtl/sizedefs.h for IS_ALIGNED in app_arena.c
[no changelog]
e122517a · Sep 14, 2026 · 2 filesLow 26chore(core): production feature cleanup
[no changelog]
This is a small build-configuration cleanup in the Trezor firmware. It changes which internal feature flag the 'production' build mode depends on, removing one old reference and switching another. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be routine maintenance to keep production builds using the correct set of features.
85e92c09 · Sep 14, 2026 · 2 filesTriage 0fix(core): stop building the secmon per firmware variant
The secmon does not depend on which firmware variant is being built, and
nothing in it ever did. Its build-options table said otherwise:
btc-only = { false = ["universal_fw"] }
unsafe-fw = { true = ["unsafe_fw"] }
Both features were inert -- declared `= []` in the secmon's Cargo.toml and
referenced nowhere in its sources -- so they could not change what the secmon
DOES. What they did change is which cargo unit built it, and therefore its
bytes: one secmon per variant, all behaving identically, differing only in ways
nobody asked for. Anything downstream that has to reason about "the" secmon for
a model then has several to choose from, with nothing to distinguish them.
Removing both mappings makes every firmware variant build one identical secmon,
which is what the code always assumed. Prodtest keeps its own: it is a separate
project with its own secure module.
`production` stays mapped -- that selects a key set, which the secmon really
does depend on.
[no changelog]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
53b2a0d7 · Sep 14, 2026 · 2 filesTriage 0fix(core/delizia): enlarge progress text
[no changelog]
90fe4201 · Sep 14, 2026 · 2 filesTriage 0feat(core/xtask): let `flash --combined` take an explicit image
`--file` already replaces the artifact on the single-project path. Accept it for
a combined image too, so one can be flashed without having been produced by
`xtask combine` in this tree -- an image from a colleague, or one kept with a
test fixture.
It keeps the meaning it has elsewhere: WHAT is written, never WHERE. The address
stays the boardloader's, because that is where a combined image starts whatever
produced it.
The two sources fail differently, so they say so differently: an explicit file
reports "Failed to locate ... for flashing" like the single-project path, while
the built artifact keeps the `xtask combine` hint, which is only actionable for
a path xtask owns.
[no changelog]
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2b4214cc · Sep 14, 2026 · 5 filesLow 30refactor(core): improve internal representation of protobuf definitions
[no changelog]
This commit is a code cleanup that changes how Trezor firmware internally labels 32-bit versus 64-bit integer fields in its protobuf handling. It does not add or remove security checks by itself, but it makes the type system more precise so that future integer-overflow mistakes are harder to introduce. The change is described by the author as a refactor with no changelog entry.
e1c22f58 · Sep 14, 2026 · 3 filesTriage 0fix(core): reject uvarints that don't fit into u64
[no changelog]
e05fcc98 · Sep 14, 2026 · 2 filesModerate 61fix(core): reject malformed protobuf field keys
[no changelog]
This commit fixes the way a Trezor hardware wallet's Rust code reads protobuf message field keys. Previously, if reading a field key failed, the decoder silently stopped and treated the message as complete. Now it explicitly checks whether data remains and reports an error if a malformed or truncated field key is encountered. The change prevents an attacker from sneaking invalid or truncated protobuf data past the parser, which could lead to messages being accepted even though they contain garbage or hidden fields.
62e7f181 · Sep 14, 2026 · 1 fileTriage 0tests(solana): update UI fixtures
[no changelog]
69d3435c · Sep 14, 2026 · 7 filesModerate 60refactor(core/sys): make writing bootargs a privilege, not a convention
The smcall surface exposed a raw bootargs setter, letting unprivileged code name
any boot command. It had no user -- firmware goes through the reboot_* calls in
bootutils.h, each of which fixes its own -- so remove it rather than filter it.
The dispatch's fatal default is then the enforcement.
Make the rule structural too: bootargs_set is declared only under SECURE_MODE,
and system_emergency_rescue is compiled only where bootargs can be written. It
linked before only because --gc-sections dropped it as unreferenced.
[no changelog]
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit removes a low-level interface that let any software component tell the device what to do on its next reboot. The change makes reboot control a privileged operation only, so unprivileged code can no longer pick arbitrary boot commands. It is a hardening/refactoring change rather than a documented fix for a specific active bug.
eaffadba · Sep 14, 2026 · 8 filesInformational 15docs(crypto): reproduce third-party license texts in crypto/LICENSE (#7529)
* docs(crypto): reproduce third-party license texts in crypto/LICENSE
Several components of crypto are not covered by the MIT license at the top
of crypto/LICENSE, and some of them (Gifford's SHA-2, the Monero files,
Gladman's AES) require their copyright notice and disclaimer to accompany
binary distributions as well as source. Until now that text existed only in
the individual file headers, which a binary consumer never receives.
Append to crypto/LICENSE a verbatim reproduction of every third-party
license, the files each one covers, the additional copyright holders under
the MIT terms, the public domain / CC0 components, and the GPL-licensed
files. Point at it from LICENSE.md and state that it must be distributed
together with binaries built from crypto.
No code changes; the existing MIT block is unmodified.
* chore: change licence of first-party code from GPL to MIT
(cherry picked from commit e7be2cc8cfffe6906ab7cb96958e8e67d88372f2)
* docs(crypto): add missing third-party attributions to crypto/LICENSE
Add entries for files whose authorship was missing or covered by an
over-broad glob: Dusan Klinec's monero sources, aes/aestst.c under
Brian Gladman's older non-endorsement licence variant, Andrew Moon's
poly1305-donna, and D. J. Bernstein's eSTREAM ECRYPT headers. Narrow
the chacha20poly1305/ entry to the files actually written by Will Glozer.
(cherry picked from commit e7a3c82d6d99548f428a45d5d6caf108795463ac)
* chore: fix typos in licences
(cherry picked from commit f23f9b659e3520ddd962c29b3b59e67a3d30a318)
---------
Co-authored-by: Ondřej Vejpustek <ondrej.vejpustek@satoshilabs.com>
This commit is purely legal and administrative housekeeping. It adds missing third-party copyright notices and license texts to the crypto/LICENSE file, fixes a typo in a few license headers, and changes the stated license of some first-party files from GPL to MIT. No executable code was changed, so it cannot introduce a security vulnerability or fix one.
8c5c81b3 · Sep 13, 2026 · 13 filesInformational 20fix(core/delizia): switch title/desc in pin popup
[no changelog]
This commit fixes a UI wording mix-up on Trezor devices when a user enters a PIN that doesn't match. Previously, the title and description in the 'PIN mismatch' popup were swapped, which could briefly confuse the user about what went wrong. There is no evidence this affects security beyond a minor user-experience issue.
74ec8983 · Sep 13, 2026 · 2 filesInformational 15feat(core/caesar): use Marquee in ConfirmHS
[no changelog]
This commit is a user-interface tweak for the Trezor hardware wallet's Caesar layout. It replaces a static title label with a scrolling 'Marquee' text effect on the homescreen confirmation screen, so long device labels remain readable. There is no security-relevant change here.
ee76924b · Sep 13, 2026 · 3 filesTriage 0fix(core): remove double _colon strings from en.json
[no changelog]
a50eb65e · Sep 13, 2026 · 13 filesInformational 15fix(core): remove double _colon strings from show_address_details
- removes their explicit use from Rust code
- adds them to python processed by with_colon
[no changelog]
This commit is a straightforward user-interface string refactor. It moves the colon that appears after labels like 'Account:' and 'Derivation path:' out of the embedded Rust translation strings and into the Python code that calls the address-details screen. There is no security-relevant change in behavior—only where the colon is appended.
3c33f184 · Sep 13, 2026 · 1 fileTriage 0fix(core): remove double colons in Tron confirm send and summary
[no changelog]
90cebdcf · Sep 13, 2026 · 3 filesInformational 15feat(core/delizia): use Marquee in PIN prompts
- PIN keyboard prompts might be longer than screen width, especially
wipe code prompts
[no changelog]
This commit changes the Trezor hardware wallet's PIN entry screen so that long prompt messages scroll horizontally (like a marquee sign) instead of being cut off. It is a user-interface improvement to handle longer text, such as wipe-code prompts. There is no security vulnerability visible in the code change.
aac05ac4 · Sep 13, 2026 · 2 filesInformational 19fix(core/eckhart): attempts width in PIN keyboard
[no changelog]
This commit fixes a layout bug in the PIN entry screen on Trezor's Eckhart hardware model. Previously, the area showing how many PIN attempts remain was given a fixed width of 85 pixels, which could be too narrow for some languages and cause the text to be cut off or poorly displayed. The patch now dynamically measures the actual text width and reserves space accordingly, with a small gap between the prompt and attempts text. There is no direct security vulnerability here; it is a UI correctness and localization improvement.
b76548b2 · Sep 13, 2026 · 2 filesTriage 0fix(core/eckhart): 2-line text for HomeBar
- ButtonContent::HomeBar now splits text into 2 lines if it doesn't fit,
in such a case, the homebar menu icon is omitted
[no changelog]