CommitWatch RSS
TZ
← All projectsTrezor

Trezor firmware

Firmware monorepo for Trezor One, Model T, and Safe devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

2650 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

915security candidates307second-pass queue956AI analyses
338commits · 30 days
577commits · 60 days
1352commits · 180 days
2649commits · 365 days
Backfill bands
Aug 5 → Feb 61298 seen115 candidatesComplete
Feb 6 → Jun 6775 seen58 candidatesComplete
Jun 6 → Jul 6217 seen13 candidatesComplete
Jul 6 → Aug 5360 seen54 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
470Strong · 80–100
1316Adequate · 60–79
859Thin · 40–59
5Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Andrew Kozlik702427266
tychovrahe292104106161
Jakub Janků19912184
Martin Pastyřík2389173
Roman Zeyde566176195071
cepetr1968282059
Ioan Bizău2307676059
obrusvit2137679064
M1nd3r2067174071
Lukas Bielesch846767067
PrisionMike945962073
Martin Milata1744646063
Analysis record

Published AI watches

Last scanned 54 minutes ago

Informational 18 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove sha1 from regular FW

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on…

Removal of a deprecated cryptographic primitive (SHA-1) from the firmware API surfaceReduction of attack surface and prevention of future misuse of a collision-vulnerable hashNo direct vulnerability patch or memory-safety bug is present in the diff
16d15774by M1nd3r+0−2006 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality ref…

Cryptographic key handling changed: public key is now supplied rather than derivedPotential reduction of key-mismatch risk if caller provides correct public keyNew null-pointer check added for static_public_key
1b3128a4by Ondřej Vejpustek+20−92 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): change order of parameters

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

33a119eeby Ondřej Vejpustek+15−151 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 47 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): prefix enums

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave …

f1c74046by Ondřej Vejpustek+26−222 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): prevent calling `memzero(NULL, ...)`

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but i…

NULL pointer passed to memory-zeroing helper in cryptographic codeUndefined behavior in C standard library contractDefensive hardening in Noise protocol implementation
0394e934by Ondřej Vejpustek+11−51 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(crypto): return remote static key from `noise_xxpsk3_*_handle_*()`

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure…

Removal of long-term public key storage from internal handshake stateCaller-supplied output buffer for remote static public key reduces internal secret retentionError-path memzero of returned key material on failure
3ead1aa6by Ondřej Vejpustek+79−423 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(xtask): introduce project-toml build-options

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug bui…

Build-option mapping now lives in project.toml files, increasing the attack surface for supply-chain/build-configuration tamperingMakefile change automatically enables debug-link for PYOPT=0 debug buildsValidation added to reject storage_insecure_testing_mode in production builds
d44de007by cepetr+681−40817 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(ethereum): fix incorrect address checksum

This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezo…

2b1938ccby Tomas Martykan+52−523 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove scons related files

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…

a4b25c31by cepetr+5−927554 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): assorted micropython-1.28.0 fixes

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…

Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
7ba7879dby Martin Milata+36−4012 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_cstr

This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.

6a889e6aby Martin Milata+3−33 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace hexlify with bytes.hex()

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change remov…

44aa469eby Martin Milata+1334−1383120 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): replace m_new_obj_with_finaliser

This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The chang…

No security-relevant logic changes observedNo input validation changesNo memory safety bug fixes (e.g., no overflow, use-after-free, or uninitialized memory fixes)
142794eaby Martin Milata+40−5619 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): bundle the utimeq module

This commit is a routine maintenance refactor. MicroPython removed its built-in 'utimeq' module, so Trezor copied the same code into its own firmware tree and renamed it to 'timeq'. There is no security bug being fixed and no new vulnerabi…

617bc806by Martin Milata+284−2211 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): use mp_obj_new_str_from_vstr

This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says t…

Refactor only: helper function renames with equivalent semanticsNew str helper adds UTF-8 validation; bytes helper does not validateNo input validation, length, or error-handling changes observed
7ea11191by Martin Milata+72−7433 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): switch to slots-based mp_obj_type_t

This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. T…

ab51798fby Martin Milata+163−16624 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core/rust): bindgen wrapper for calling static micropython functions

This commit is a straightforward internal code refactor. It adds a small C wrapper file so that Rust code can call two specific internal MicroPython functions that are declared as static/inline in headers. There is no user-facing change, n…

d5121d92by Martin Milata+20−06 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): adjust mpy-cross paths

This commit is a routine build-system update for the Trezor firmware. It changes where the build process looks for the MicroPython cross-compiler binary (mpy-cross) and synchronizes a configuration header with newer MicroPython code. There…

2ef70e16by Martin Milata+18−264 files
No security note in commit
Open full analysis →Source commit ↗
Low 30 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): collect micropython GC root pointers

This commit updates the Trezor firmware build system to use a newer MicroPython mechanism for tracking special memory pointers called 'root pointers.' It removes hard-coded lists of these pointers from configuration files and instead colle…

GC root pointer handling changedBuild system now auto-collects root pointers instead of hard-coding themRemoves manual MICROPY_PORT_ROOT_POINTERS lists
fc128f3dby Martin Milata+75−107 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityrefactor(core): make power manager driver selectableby tychovrahe · 4941ceac · Jul 24, 2026 · 9 filesMessage 62 · AdequateTriage 0Details
Commit message · tychovrahe

refactor(core): make power manager driver selectable

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityfeat(core/prodtest): add ble-monitorby tychovrahe · 16ced179 · Jul 24, 2026 · 5 filesMessage 57 · ThinTriage 0Details
Commit message · tychovrahe

feat(core/prodtest): add ble-monitor

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatechore(core): bump version to 2.12.4by Martin Milata · 98259629 · Jul 23, 2026 · 8 filesMessage 57 · ThinInformational 15Details
Commit message · Martin Milata

chore(core): bump version to 2.12.4

[no changelog]

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a routine version bump from 2.12.3 to 2.12.4 for the Trezor firmware. It only changes the version number in one header file and updates the same version number in translation files, plus refreshes the translation signature metadata. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

Lower-priorityfix(core): store packet across session restart during channel preemptionby Martin Milata · 4367a35a · Jul 23, 2026 · 4 filesMessage 77 · AdequateTriage 0Details
Commit message · Martin Milata

fix(core): store packet across session restart during channel preemption

This way TRANSPORT_BUSY is not sent and host doesn't have to retransmit
the packet.

[no changelog]

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritydocs(core): THP synchronization layer clarificationby Martin Milata · 74d3b048 · Jul 23, 2026 · 3 filesMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata

docs(core): THP synchronization layer clarification

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritychore(core): less confusing log message when decoding protobufby Martin Milata · bb5133c4 · Jul 23, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata

chore(core): less confusing log message when decoding protobuf

[no changelog]

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI review queuedrefactor(core/bitcoin): Consolidate external input classification.by Andrew Kozlik · e70633ee · Jul 23, 2026 · 2 filesMessage 77 · AdequateInformational 12Details
Commit message · Andrew Kozlik

refactor(core/bitcoin): Consolidate external input classification.

(cherry picked from commit 2042aec0ba7316c268548b1297691e750ed2112c)

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit is a code cleanup (refactor) in the Bitcoin signing code of the Trezor firmware. It introduces a helper that classifies external transaction inputs into three categories (presigned, has ownership proof, or unverified) and uses that helper in two places instead of duplicating the same checks. The behavior appears unchanged; there is no indication this fixes or introduces a security bug.

Lower-priorityfix(core): discard low-order keys in Code Entry pairingby M1nd3r · 328d692f · Jul 23, 2026 · 4 filesMessage 77 · AdequateTriage 0Details
Commit message · M1nd3r

fix(core): discard low-order keys in Code Entry pairing

[no changelog]

(cherry picked from commit c0aa2eb4777c80f4e3f63c5c6da878cda5a956ed)

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Security candidatefix(solana): show account owner to userby Jakub Janků · f3d5724f · Jul 23, 2026 · 3 filesMessage 80 · StrongHigh 76Details
Commit message · Jakub Janků

fix(solana): show account owner to user

When assigning an `owner` to an account, using the `CreateAccount`,
`CreateAccountWithSeed`, or `AllocateWithSeed` instructions, it is
critical to display the value to the user. Usually, the owner is a
well-known Solana program, such as the System program
(11111111111111111111111111111111) or the Stake program
(Stake11111111111111111111111111111111111111). However, an attacker
could set the value to a Solana program that is controlled by them
and later drain money from the account. This is especially problematic
since the two `CreateAccount` instructions immediately send funds to
the new account.

[no changelog]

(cherry picked from commit d3f24b0f6739cdae93074c5a4f60658e15c456e0)

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
explicit security languagesigning boundarysigning or wallet path
AI analysis · High 76/100

This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner could be hidden from the user, allowing an attacker to later seize funds sent to the freshly created account. The fix is purely a user-interface change on the hardware wallet screen, not a change to Solana itself.

Lower-prioritytest(core): update `InputFlowEIP712ShowMore`by Roman Zeyde · ad2545b6 · Jul 23, 2026 · 2 filesMessage 72 · AdequateTriage 0Details
Commit message · Roman Zeyde

test(core): update `InputFlowEIP712ShowMore`

[no changelog]

(cherry picked from commit a26e6e3211892d86650b6fabc29f7e6b11faa962)

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
AI review queuedfix(core): solana transfer showing LUT addressby obrusvit · 537b34f8 · Jul 23, 2026 · 4 filesMessage 72 · AdequateModerate 63Details
Commit message · obrusvit

fix(core): solana transfer showing LUT address

(cherry picked from commit e306dd41b41fea3cec3e3a75cedd501e8ad77a86)

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 63/100

This update fixes a display bug in Trezor's Solana token transfer screens. When a transaction destination was stored in an off-device 'address lookup table' (ALT), the device used to show the lookup table's own address as the recipient, instead of admitting it could not resolve the real destination. The fix makes the device fall back to a more honest, reference-aware display so users are not misled into approving transfers to the wrong address. This is a user-interface/confusion issue rather than a remote code execution flaw.

Lower-prioritychore: update definitions timestampby PrisionMike · be4b6f92 · Jul 23, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · PrisionMike

chore: update definitions timestamp

(cherry picked from commit fe755ca29f8189dc607e3ada32d62da3e6d6ca4b)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritychore: update releases.jsonby PrisionMike · 21b2bf34 · Jul 23, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · PrisionMike

chore: update releases.json

(cherry picked from commit 7c40437a7f2dc992bdb970fbdf142bd4a15ca25a)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritychore: upload signed secmonby PrisionMike · b5fd9797 · Jul 23, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · PrisionMike

chore: upload signed secmon

(cherry picked from commit 9bbc7113b08ac42d430f8863c8653a32a81b26e3)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritydocs(core): update changelog for 2.12.3by Martin Milata · 8cd9878c · Jul 23, 2026 · 7 filesMessage 72 · AdequateTriage 0Details
Commit message · Martin Milata

docs(core): update changelog for 2.12.3

(cherry picked from commit d5c79a8512ed8b318d26d6c9cf015b95a846b2e5)

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Lower-prioritychore: update releases.jsonby Martin Milata · bdb20d34 · Jul 23, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata

chore: update releases.json

(cherry picked from commit 0d3dee246dadb2ee6ee449272f4936a4ff6bbdff)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
AI review queuedchore(core): sign translationsby Martin Milata · 8b4afd25 · Jul 23, 2026 · 1 fileMessage 62 · AdequateTriage 0Details
Commit message · Martin Milata

chore(core): sign translations

[no changelog]

(cherry picked from commit b09832e821eac9ba247351037a2c8e2b585cad7c)

62/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathtranslation-only discountsecond-pass: security-sensitive path
Lower-prioritychore(core): update fixturesby Martin Milata · 30f0e79d · Jul 23, 2026 · 1 fileMessage 47 · ThinTriage 0Details
Commit message · Martin Milata

chore(core): update fixtures

[no changelog]

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatechore: update translation signatureby PrisionMike · 0510df27 · Jul 23, 2026 · 1 fileMessage 67 · AdequateInformational 15Details
Commit message · PrisionMike

chore: update translation signature

(cherry picked from commit a062363333256d4a64b48c8824e445b7aa67648a)

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarysigning or wallet pathtranslation-only discount
AI analysis · Informational 15/100

This commit simply adds a new approved digital signature for translation data files used by Trezor hardware wallets. It is a routine metadata update with no visible security bug or code change.

AI review queuedfix(solana): check unique stake withdraw recipientby Jakub Janků · 31e05613 · Jul 23, 2026 · 2 filesMessage 85 · StrongModerate 62Details
Commit message · Jakub Janků

fix(solana): check unique stake withdraw recipient

Prior to this commit, trezor used special UI flow for solana
transactions that contained only stake withdraw instructions. The
problem was that only the total withdrawn amount was shown without the
per-recipient breakdown of the amount.

This change restricts the use of the special flow only to cases where
the recipient is the same across all withdraw instructions. This unifies
the behavior of the `try_confirm_token_transfer_transaction` and
`try_confirm_staking_transaction` functions. If the recipient differs
from the signer, a warning is shown.

NOTE: This change also fixes the issue that the special flow could be
aborted without user interaction --- this could happen when the
transaction contained one supported instruction (by the special flow)
with a recipient other than the wallet and one unsupported instruction.
First, the user would see the recipient warning (part of the special
flow), but then this flow would be aborted and the default per-
instruction confirmation flow would start.

(cherry picked from commit 6b84dcdd241410c90fce8dbd4d8f8a2454aceeaf)

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 62/100

This update fixes a display issue in Trezor's Solana staking withdrawal flow. Previously, when withdrawing staked SOL, the device could show only the total amount being withdrawn even if multiple different recipients were involved, and in some mixed transactions it could silently drop back to a normal flow after showing a warning. Now the device requires all withdrawals in a simplified transaction to go to the same recipient, and it explicitly asks the user to confirm that recipient if it is not their own wallet.

AI review queuedfix(core/bitcoin): Fix external input misidentification.by Andrew Kozlik · 675fa659 · Jul 23, 2026 · 5 filesMessage 77 · AdequateHigh 72Details
Commit message · Andrew Kozlik

fix(core/bitcoin): Fix external input misidentification.

(cherry picked from commit 23bbf680071f7ede286dc3eda2f4baa7193288b2)

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · High 72/100

This update fixes a bug in the Trezor hardware wallet's Bitcoin transaction signing. When a transaction included an external input (someone else's coin) with empty placeholder fields, the device could mistake it for an already-signed input. That would let it skip both signature verification and the warning that tells the user the input is unverified. The fix makes the device treat empty bytes the same as missing fields and rejects ownership proofs on internal or already-signed inputs.

AI review queuedfix(core/bitcoin): Reject new external outputs in bitcoin replacement transactions.by Andrew Kozlik · 62891383 · Jul 23, 2026 · 3 filesMessage 77 · AdequateHigh 72Details
Commit message · Andrew Kozlik

fix(core/bitcoin): Reject new external outputs in bitcoin replacement transactions.

(cherry picked from commit a06d11ea82dcc796106a289084c958cbe76a5caf)

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · High 72/100

This update fixes a security gap in how Trezor handles Bitcoin 'replacement transactions' (used to speed up or adjust a pending payment). Before the fix, a non-payjoin replacement could silently add a brand-new external recipient output, potentially redirecting some of the user's funds without asking for on-device confirmation. The patch now rejects any new external output in non-payjoin replacement transactions, so the device will block such changes and show an error instead of signing.

AI review queuedchore(core): simplify EIP-712 domain confirmation flowby Roman Zeyde · b408aa0a · Jul 23, 2026 · 3 filesMessage 85 · StrongInformational 18Details
Commit message · Roman Zeyde

chore(core): simplify EIP-712 domain confirmation flow

`EIP712Domain` contains up to 5 fields, so it would be much simpler to
always confirm all of them, instead of caching and re-streaming.

[no changelog]

(cherry picked from commit e9f5ebdd496098f07f8c62698b2ecf17615feccd)

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit simplifies how a Trezor hardware wallet asks the user to confirm details when signing Ethereum typed-data messages (EIP-712). Previously, the device first showed only the domain name and version and asked the user to press 'show more' to see the rest; now it always shows all domain fields. The change removes about 50 lines of caching and preview logic. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a user-interface simplification.

AI review queuedfeat(core): group EIP-712 domain confirmationsby Roman Zeyde · 09e3f9cb · Jul 23, 2026 · 8 filesMessage 88 · StrongInformational 18Details
Commit message · Roman Zeyde

feat(core): group EIP-712 domain confirmations

It should require less confirmations on Bolt, Delizia and Eckhart,
since `EIP712Domain` doesn't contain nested members [1].

Also, show a warning if `EIP712Domain` is empty.

[1] https://eips.ethereum.org/EIPS/eip-712#definition-of-domainseparator

[no changelog]

(cherry picked from commit b4af7c01db0b0352d81d4db47ec0ec767e559e8d)

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit changes how Trezor devices ask the user to confirm details for EIP-712 typed Ethereum signatures. Instead of showing each piece of the 'EIP712Domain' section one by one, it groups them into a single screen on newer devices. It also adds a warning when the dApp provides an empty EIP712Domain, which means the app did not identify itself. The change is a user-experience improvement with a small defensive-security side effect, not a fix for an active vulnerability.

Security candidatefeat(core): show maximal coordinator fee rateby Roman Zeyde · e369fb17 · Jul 23, 2026 · 18 filesMessage 72 · AdequateInformational 20Details
Commit message · Roman Zeyde

feat(core): show maximal coordinator fee rate

[no changelog]

(cherry picked from commit 85c405ef787a1e815a47f757e1be1b78afbdfbed)

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathboot or update pathauthentication path
AI analysis · Informational 20/100

This commit adds a new line on the Trezor screen when authorizing a CoinJoin: it now shows the 'Max coordinator fee rate' alongside the existing 'Max rounds' and 'Max mining fee'. This is a user-interface improvement that gives the device owner more information before they approve a CoinJoin session. It does not change any security logic, fee enforcement, or authorization checks; it only displays an extra value that was already part of the authorization message.