Firmware monorepo for Trezor One, Model T, and Safe devices.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61298 seen115 candidatesCompleteFeb 6 → Jun 6775 seen58 candidatesCompleteJun 6 → Jul 6217 seen13 candidatesCompleteJul 6 → Aug 5360 seen54 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 12 minutes ago
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PI…
1dbc2c3cby Michal Kazda+22−422 filesThis commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of p…
4a9cf168by cepetr+335−3112 filesThis commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellma…
429a283dby M1nd3r+45−74 filesThis commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix;…
d434a636by Jakub Janků+1−11 fileThis commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that fut…
7b58e75aby Jakub Janků+55−018 filesThis commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type c…
1cc940a4by cepetr+162−15247 filesThis commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-…
65402aecby Michal Kazda+2−103 filesThis commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior cha…
7ce6887fby Michal Kazda+5−184 filesThis commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …
dc937ba2by tychovrahe+81−711 fileThis commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…
caab7d9eby tychovrahe+772−4834 filesThis commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…
1436fbc6by cepetr+2−158 filesThis commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…
e231cc94by obrusvit+50−502 filesThis commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts …
6be32440by cepetr+48−32025 filesThis commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability be…
890aca93by cepetr+13−14 filesThis commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6dc781c2by M1nd3r+1202−203250 filesThis commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no securit…
6d69df16by Michal Kazda+20279−2023911 filesThis is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
162ed3a2by Michal Kazda+12−125 filesThis commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
a56f8c3dby Roman Zeyde+0−22 filesThis commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryp…
739c2968by Michal Kazda+19332−193364 filesThis commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant chan…
c66f6f4dby Michal Kazda+51−7413 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
7699fc84 · Sep 12, 2026 · 2 filesTriage 0feat(core/emu): implement --lang param
[no changelog]
1ecd07bd · Sep 11, 2026 · 2 filesTriage 0feat(core): reserve SRAM for external apps
[no changelog]
0846f204 · Sep 11, 2026 · 11 filesTriage 0feat(core): add mldsa44_verify smcall
[no changelog]
cd29104c · Sep 11, 2026 · 47 filesInformational 15feat(core): introduce app_arena
[no changelog]
This commit is a large internal refactor of the Trezor firmware's third-party application loading system. It replaces the old ELF-based app loader with a new 'app_arena' subsystem that uses a custom binary format, Merkle-tree header verification, and ML-DSA-44 root-of-trust signatures. The change is explicitly marked as a feature ('feat(core): introduce app_arena') with '[no changelog]' and contains no vendor statement that it fixes a security bug. It appears to be a planned architectural redesign, not a security patch.
dafff53e · Sep 11, 2026 · 2 filesTriage 0docs(core): update embed-arch docs
[no changelog]
6ab901c1 · Sep 11, 2026 · 2 filesTriage 0feat(stellar): add Centrifuge SEP-41 definitions
fce695b7 · Sep 11, 2026 · 1 fileTriage 0refactor(stellar): link to Solv Protocol SEP-1 file
... and remove redundant comments.
[no changelog]
04ed8330 · Sep 11, 2026 · 4 filesLow 37feat(solana): confirm space when creating accounts
We already let the user confirm the space parameter of the Allocate
(With Seed) instruction. For consistency, do the same for the Create
Account (With Seed) instruction.
This commit adds an on-screen confirmation step for the 'space' (data size) parameter when creating new Solana accounts on a Trezor device. Previously, this parameter was hidden from the user during Create Account instructions, even though it was already shown for a related 'Allocate' instruction. The change improves consistency and helps users spot transactions that request unexpectedly large storage allocations, which could be a sign of a malicious or misleading transaction.
7ab83a2a · Sep 11, 2026 · 6 filesTriage 0feat(core): report `Miniscript` capability
It would allow automatically skipping miniscript-related device tests
using `pytest.mark.capabilities(Capability.Miniscript)` marker.
[no changelog]
45b1c0a0 · Sep 10, 2026 · 1 fileTriage 0fix(core): add colons to info_items in Bolt layout
[no changelog]
2aec9696 · Sep 10, 2026 · 1 fileInformational 15tests(clear_signing): unit tests for .from_proto()
[no changelog]
This commit only adds new unit tests for an existing Ethereum clear-signing decoder. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one directly. The tests document how the decoder currently handles various Ethereum ABI data shapes and which malformed inputs it rejects.
539d7a31 · Sep 10, 2026 · 1 fileTriage 0test(stellar): require stellar_sdk
[no changelog]
ae5d884e · Sep 10, 2026 · 3 filesTriage 0refactor(core): simplify `strings.format_timestamp()`
No need to subtract and add `TIMEUTILS_SECONDS_1970_TO_2000`, since `MICROPY_TIMESTAMP_IMPL_LONG_LONG` is defined, therefore:
```
typedef long long mp_timestamp_t;
```
[no changelog]
95adcc90 · Sep 10, 2026 · 29 filesInformational 15feat(common,core,python,tests): support creating Stellar contracts.
Support `CREATE_CONTRACT_V2` in `InvokeHostFunctionOp` and
`CREATE_CONTRACT_V2_HOST_FN` in Soroban authorization entries.
This commit adds support for a new Stellar blockchain feature: creating smart contracts (contract deployment) on Trezor hardware wallets. It extends the messages, layouts, serialization, and tests so users can review and sign Stellar 'create contract' transactions and related authorization entries. There is no indication of a security vulnerability in the change itself; it is a feature addition with explicit user confirmation steps and deliberate exclusions of unsupported variants.
8d312f5c · Sep 10, 2026 · 9 filesInformational 14refactor(core/stellar): prepare for contract creation support.
- Share the HashIDPreimage header (envelope type and network ID) between
the Soroban authorization payload and contract address derivation.
- Move the CONTRACT_ID_PREIMAGE_FROM_ASSET writer next to the other
writers.
- Rename `sac_address_from_asset` to `contract_address_from_asset` and
move it to `helpers.py`.
- Extract `_confirm_args` and `_same_xdr` for reuse.
[no changelog]
This commit is a routine internal code cleanup in the Stellar cryptocurrency support of Trezor firmware. It renames and moves helper functions, extracts reusable pieces, and adds tests. There is no change to user-visible behavior or security boundary, and no security issue is apparent.
d1b96998 · Sep 10, 2026 · 4 filesTriage 0feat(core): support NFC discovery in MicroPython
[no changelog]
8c2a19ae · Sep 9, 2026 · 2 filesTriage 0chore(deps): add stellar_sdk>=15
trezorlib and parts of the device tests increasingly rely on
stellar-sdk, especially since the recent Soroban additions, and
trezorctl stellar is virtually useless without it. The package is
nevertheless still only an optional extra of trezorlib and has never
been installed in CI, so several problems went unnoticed for a long
time: typing errors (see 581e92f3 and 26535d93) or the test_xdr
fixtures that were never recorded (see 9a1ee9a312).
This commit adds stellar_sdk to workspace dependencies to make
trezorctl stellar usable out of the box and prevent similar issues
from occuring again in the future.
[no changelog]
d0f50b4d · Sep 9, 2026 · 4 filesLow 37fix(core): correct timestamp conversion in `time_gmtime2000()`
It was working on the emulator (since `mp_int_t` is 64-bit)
but failing on HW devices.
Also, improve `test_lock_time_datetime` coverage.
Note: `2106-02-07 06:28:15` = 2**32-1 seconds from epoch.
This commit fixes a date-handling bug in Trezor hardware wallets. The device converts Bitcoin transaction lock-time timestamps into human-readable dates on its screen. Before the fix, the code used a 32-bit signed integer on real hardware, so any date after the year 2038 (and in practice after about 2068 in this code) would be misread and the wrong date would be shown to the user. The fix switches to a 64-bit timestamp type and adds tests for far-future dates up to the year 2106. The main risk is that a user could be tricked into approving a transaction whose real lock-time date is different from what the device displays.
226a6f76 · Sep 9, 2026 · 1 fileTriage 0ci(core): exclude UI fixtures & coverage upload for unstable builds
Will be used to exclude miniscript as well in a following PR.
[no changelog]
f050b127 · Sep 9, 2026 · 2 filesTriage 0feat(core/rust): decrease size of Qstr type to u16
which is perfectly legal now that we have Attribute type to cover the
ffi::qstr case.
985af29e · Sep 9, 2026 · 1 fileTriage 8fix(core): harden `zcash.f4unjumble()`
[no changelog]
2dda17f8 · Sep 9, 2026 · 1 fileTriage 0refactor(core/rust): simplify device_menu_result
no reason to call an attr function if the intention is to have a static
list of locals
26535d93 · Sep 9, 2026 · 6 filesTriage 0refactor(python): move stellar-sdk based code to trezorlib.stellar_sdk_helpers
The new module imports stellar-sdk unconditionally, so pyright can narrow
isinstance() checks, which it refuses for names bound in a try/except
ImportError block. trezorlib.stellar keeps device communication only.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
581e92f3 · Sep 9, 2026 · 1 fileTriage 0fix(python): assert active XDR union arms in Stellar helpers
stellar-sdk declares every union arm as Optional, so pyright cannot tie
the discriminant check to the arm access.
[no changelog]
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1e9ebe18 · Sep 9, 2026 · 1 fileTriage 0build: add ASAN toggle to tbench manifest