Firmware monorepo for Trezor One, Model T, and Safe devices.
Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Aug 5 → Feb 61298 seen115 candidatesCompleteFeb 6 → Jun 6775 seen58 candidatesCompleteJun 6 → Jul 6217 seen13 candidatesCompleteJul 6 → Aug 5360 seen54 candidatesCompleteMessage quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
Public Git author strings; identities are not independently verified.
Last scanned 18 minutes ago
This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PI…
1dbc2c3cby Michal Kazda+22−422 filesThis commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of p…
4a9cf168by cepetr+335−3112 filesThis commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellma…
429a283dby M1nd3r+45−74 filesThis commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix;…
d434a636by Jakub Janků+1−11 fileThis commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that fut…
7b58e75aby Jakub Janků+55−018 filesThis commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type c…
1cc940a4by cepetr+162−15247 filesThis commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-…
65402aecby Michal Kazda+2−103 filesThis commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior cha…
7ce6887fby Michal Kazda+5−184 filesThis commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the …
dc937ba2by tychovrahe+81−711 fileThis commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c,…
caab7d9eby tychovrahe+772−4834 filesThis commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no secur…
1436fbc6by cepetr+2−158 filesThis commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interacti…
e231cc94by obrusvit+50−502 filesThis commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts …
6be32440by cepetr+48−32025 filesThis commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability be…
890aca93by cepetr+13−14 filesThis commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.
6dc781c2by M1nd3r+1202−203250 filesThis commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no securit…
6d69df16by Michal Kazda+20279−2023911 filesThis is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.
162ed3a2by Michal Kazda+12−125 filesThis commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.
a56f8c3dby Roman Zeyde+0−22 filesThis commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryp…
739c2968by Michal Kazda+19332−193364 filesThis commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant chan…
c66f6f4dby Michal Kazda+51−7413 filesExpand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
03fe2422 · Sep 4, 2026 · 3 filesTriage 0build(core): bump minimum python version to 3.11
[no changelog]
f408bceb · Sep 4, 2026 · 2 filesInformational 15fix(l10n): Indonesian fixes for Bolt/Caesar/Delizia
[no changelog]
This commit updates Indonesian language translations for the Trezor hardware wallet. It adjusts wording and line breaks for different device models (Bolt, Caesar, Delizia, Eckhart) and updates the translation signature file. There are no code changes and no security implications.
e890737f · Sep 4, 2026 · 1 fileTriage 8fix(core/embed): validate `cmd->data_len` in `nfc_transceive_blocking()`
[no changelog]
6f02a439 · Sep 4, 2026 · 1 fileTriage 0refactor(core/embed): use `TSH_CHECK` in `nfc_transceive_blocking()`
[no changelog]
73b47501 · Sep 4, 2026 · 1 fileTriage 0fix(python): replace pyright ignore by type ignore
[no changelog]
5674bbfb · Sep 4, 2026 · 2 filesTriage 0feat(xtask): support MIRI in tests
ae4272d1 · Sep 4, 2026 · 2 filesInformational 19feat(core/xtask): let flash take an explicit binary
`flash` could only act on the artifact the current tree just built, so a
prebuilt or archived image had no path in -- e.g. a bootloader captured from
another branch, or one kept alongside a test fixture.
`-f/--file` replaces WHAT is written, never WHERE: the destination address
still comes from the project plus the model's memory.ld, so a prebuilt binary
lands exactly where that project belongs and cannot drift from the linker
layout.
[no changelog]
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit adds a `-f/--file` option to Trezor's internal `flash` developer tool so engineers can flash a prebuilt firmware or bootloader file instead of only the binary produced by the current source tree. The same commit also fixes a command-injection risk in the OpenOCD flashing script by properly quoting file paths that contain spaces or special characters. The change is a developer convenience plus a hardening fix; it does not affect end-user device security directly.
ed9a3e31 · Sep 4, 2026 · 6 filesInformational 18build: fix builds on MacOS / clang / newer gcc
* Mach-O dislikes section ".buf"
* projects should use local version.h and not rely on it magically being
the only version.h in include path
* g_lt_log_cli is set but not read
* "TRZC" is a 5-byte string which you aren't supposed to stuff into a
4-byte array
This commit fixes several build-compatibility problems in the Trezor firmware so it compiles on MacOS, clang, and newer gcc. The changes include using the correct local header file, avoiding a special memory section name that MacOS object files reject, silencing a compiler warning about an unused log variable in emulator builds, and fixing a 5-character string being squeezed into a 4-character space. These are primarily build/robustness fixes rather than patches for an active security vulnerability.
e45e61c8 · Sep 4, 2026 · 2 filesTriage 0fix(core): assert confirmation result in Tron claim menus
Both delizia and eckhart confirm_tron_claim called interact_with_menu()
and discarded its result, so a layout result other than CONFIRMED was
treated as a confirmation. Every other menu call site either returns the
result to its caller or goes through confirm_with_menu(), which asserts
it. Use that helper here too.
[no changelog]
d1330f9e · Sep 4, 2026 · 13 filesLow 27feat(core): add a boot command that enters the bootloader ready to talk
BOOT_COMMAND_STOP_AND_WAIT lands on the bootloader's intro screen -- "Go to
bootloader menu" per the BootCommand protobuf, which is deliberate. But only
the wait-for-host screen calls workflow_ifaces_init(), so on the intro screen
the wire interfaces are not up: a host that just rebooted the device cannot
talk to it until somebody taps through.
BOOT_COMMAND_STOP_AND_CONNECT is the same stop, entered on the connect
screen instead. The whole behavioural difference is which screen the workflow
starts on:
screen_t screen = connect_to_host ? SCREEN_WAIT_FOR_HOST : SCREEN_INTRO;
It authorizes nothing -- no consent material, no effect on any validity gate
-- which is what makes it safe to hand to firmware, unlike CONTINUE_UPGRADE
(deliberately bridge-less so firmware cannot reach the weaker boot gate).
reboot_and_connect() therefore gets the usual syscall AND smcall bridges,
since firmware runs unprivileged.
The motivating case is a caller that has just invalidated its own firmware
and knows a host is waiting: the intro screen would strand the device behind a
tap it has no way to ask for. Not exposed over the wire yet; a host-initiated
RebootToBootloader still lands on the menu, which a later protobuf addition
could fix.
[no changelog]
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit adds a new internal reboot path that lets the Trezor Core firmware restart the device into the bootloader and immediately activate the USB/wire connection, skipping the usual intro screen that normally requires a finger tap. The change is intentionally limited: it does not approve any firmware installation, downgrade, or other security-sensitive action; it only changes which screen the bootloader shows first. It is exposed to unprivileged firmware through both a normal system call and a secure-monitor call, but it is not yet reachable from a host computer over USB. The main security consideration is that it slightly enlarges the attack surface for reboot-based attacks, though the commit message and code comments explicitly describe it as authorization-free and safe compared to the existing auto-upgrade reboot command.
1b09ecdf · Sep 3, 2026 · 1 fileTriage 0docs: fix screenshot key
[no changelog]
ac25643b · Sep 3, 2026 · 3 filesInformational 15chore: remove deadcode from `pyright_tool.py`
- features removed are not used anywhere
[no changelog]
This commit is a routine cleanup of an internal Python linting helper script. It removes unused features from `pyright_tool.py` (a tool that manages type-checker suppressions) and updates two comments in unrelated firmware source files to match a new alias format. There is no change to the actual Trezor firmware code that runs on devices, no security fix, and no vulnerability.
8eb27f83 · Sep 3, 2026 · 2 filesInformational 11chore(core): save 15KB of flash by eliminating source filenames
[no changelog]
This commit is a routine size-optimization change for the Trezor firmware. It removes source filenames from compiled code to save 15KB of flash storage and rearranges linker sections. There is no indication this is a security fix or introduces a vulnerability.
54a213d7 · Sep 3, 2026 · 18 filesInformational 15chore(tests): use named parameters
[no changelog]
Co-Authored-By: Claude Opus 5 (1M) <noreply@anthropic.com>
This commit only rewrites test code to use named pytest parameters (adding readable IDs to test cases). It does not change any production firmware, wallet logic, or security behavior. There is no security issue here.
37dc357f · Sep 3, 2026 · 5 filesTriage 0chore: use ruff instead of autoflake
- ruff can also remove imports
[no changelog]
7ae1dc05 · Sep 3, 2026 · 3 filesTriage 0fix(core): explicit rejection in menu unknown results, better type handling, better list usage
- `cancel_leaf()` and `show_menu()` now reject results they do not
expect instead of silently treating them as "go back". Previously
anything that was not CONFIRMED counted as a declined cancellation,
and any non-index result from `select_menu` fell through to leaving
the current level.
- `cancel_leaf()` returns `MenuLeaf[R]` rather than `MenuLeaf[Never]`.
`Never` was the more precise type, but it made `[cancel_leaf(...)]`
infer `list[MenuLeaf[Never]]`, which then rejected every information
leaf appended to it. With `R` the list infers `list[MenuLeaf[None]]`
from the TypeVar default and still narrows for trees that do return
values. The leaf produces no value either way, so it remains sound.
- Menu lists are built in place instead of by concatenation, across all
31 call sites. Conditional lists append the cancel entry once; the two
fully static ones are plain literals. `confirm_ethereum_vault_tx`,
`confirm_ethereum_vault_claim` and `confirm_solana_staking_tx` had
been rebuilding the same menu 5, 3 and 2 times respectively, and now
share one list each.
- Documented that `None` is the "resume the tree" sentinel and therefore
can never be a leaf's value, for any `R` — the types do not enforce
this.
[no changelog]
f58e7e79 · Sep 3, 2026 · 2 filesLow 25fix(core/bootloader): mark check_vendor_header_lock warn-unused-result
The three sibling checks in sec/image.h -- check_vendor_header_model, _sig
and _keys -- are all declared `secbool __wur (const vendor_header *const)`.
This one predates them in that respect and had neither the attribute nor the
second const, even though dropping its result would silently skip an
authorization check rather than fail.
No call site changes: both existing callers already consume the value (one
assigns it, one wraps it in ensure()).
[no changelog]
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This is a small hardening change to the Trezor bootloader. It adds a compiler warning attribute to a security check function so that future programmers cannot accidentally call it and ignore its pass/fail result. The current code already uses the result correctly at both call sites, so there is no active bug being fixed—only prevention of a future mistake.
581a50ed · Sep 3, 2026 · 5 filesInformational 15build(core): exclude meminfo-related code from FW builds
Saves ~7.3KB on T2T1.
Keep it for emulators.
[no changelog]
This commit is a routine firmware size optimization. It removes a developer-only memory debugging feature (meminfo) from production hardware builds to save about 7.3KB of flash storage, while keeping it available in emulator builds. There is no security vulnerability here.
c4c368c1 · Sep 3, 2026 · 2 filesTriage 0chore(ci): check each CI job has an explicit timeout
[no changelog]
Co-Authored-By: Claude Opus 5 (1M) <noreply@anthropic.com>
96de4ce3 · Sep 3, 2026 · 16 filesInformational 15chore(ci): add timeouts to all jobs
[no changelog]
This commit only adds time limits to automated GitHub Actions CI/CD jobs so they stop automatically if they run too long. It does not change any Trezor firmware code, wallet logic, cryptography, or user-facing behavior. There is no security vulnerability being fixed or introduced here.
da46bc29 · Sep 3, 2026 · 1 fileTriage 0fix(core): gate Debug derive for prod build
[no changelog]
f67410a6 · Sep 3, 2026 · 7 filesInformational 15feat(core): encapsulate select menu item in a struct
[no changelog]
This commit is a straightforward internal code cleanup in the Trezor firmware's user-interface code. It replaces a raw two-value pair (text label + intent) with a named struct called SelectMenuItem. There is no change to user-visible behavior, no bug fix, and no security-related change.
60fa1cb9 · Sep 3, 2026 · 6 filesTriage 0chore(core): introduce ExternalDataError
[no changelog]
65e3b480 · Sep 3, 2026 · 1 fileLow 27fix(core): fix image size alignment on f4 devices
[no changelog]
This commit adjusts memory layout alignment settings in the linker script used for Trezor's STM32F4 hardware wallet firmware. It moves a 512-byte alignment boundary from the end of one flash section to the end of another. The change is described by the vendor as fixing image size alignment on F4 devices. There is no explicit security claim in the commit, and the diff alone does not demonstrate a vulnerability or exploit path. It could plausibly relate to ensuring correct firmware image boundaries for secure boot or flashing, but that is speculative.
0bd16deb · Sep 3, 2026 · 1 fileInformational 15test: check `Features.max_passphrase_len` in device tests
Following 835efbb65caa8284c08da97e7378f5677eecb019, legacy and core have different passphrase limits.
[no changelog]
This commit only adds a test assertion to verify that the maximum passphrase length reported by a Trezor device matches the expected value for its model family (50 characters for legacy devices, 128 for newer 'core' devices). It is a pure test-code change with no product behavior change and no security fix.