Trezor firmware

This commit fixes two places in Trezor's payment-request handling where error objects were created but never actually thrown (missing 'raise'). One missing raise meant a payment request with memos but no nonce would be accepted instead of rejected; the other meant an unknown memo type would be silently ignored instead of rejected. The patch adds the missing 'raise' keywords, refactors nonce handling to support unit testing, and adds tests to confirm the errors are now raised. It is a genuine bug fix, but the practical security impact is bounded because the verifier still checks the cryptographic signature before any payment is approved.

This commit only changes the project's Python linter configuration file (.pylintrc) to enable two additional code-quality checks: 'pointless-exception-statement' and 'pointless-statement'. These checks flag code that has no effect, such as an expression or exception object written on its own line without being raised or used. There is no change to the firmware source code, runtime behavior, or any security-sensitive logic. It is a routine tooling/development hygiene change.

This commit changes how Trezor handles payment requests that are not tied to a specific cryptocurrency coin type. Previously, payment notifications used a placeholder coin ID of 0 (Bitcoin). Now they use a new 'undefined' marker (0xFFFFFFFF). The change also adds a safety check so that refund memos cannot be used when no coin type is defined, because Trezor cannot hold coins of an undefined type. This appears to be a defensive refactor rather than a fix for an active vulnerability, but it removes a potentially misleading use of Bitcoin's coin ID in non-payment contexts.

This commit simply adds a routing entry so that when the Trezor device receives a 'PaymentNotification' message, it knows which internal module to run. There is no visible security fix or vulnerability here—only a new message handler being wired up.

This commit only adds a new automated test for an existing feature called payment_notification, and makes a small helper function in the test code tolerate missing output data. There is no change to the actual Trezor firmware or to any code that runs on the device. It is a test-only change and does not introduce or fix a security issue.

This commit adds a new feature to Trezor hardware wallets that lets users confirm on the device when they are buying cryptocurrency with regular money (fiat) through a third-party service. It changes how payment requests are verified and displayed on the device screen. The change removes the requirement that a payment amount be included in the request for these fiat-to-crypto purchases, because the amount being spent is in regular currency rather than cryptocurrency.

This commit is a user-interface refactor that lets the Trezor device display trade confirmations even when there is no 'sell' amount. Previously the code assumed every trade was a swap (sell something to buy something). Now it can handle cases where only a buy amount is shown, such as a direct purchase or sale-to-fiat. The change touches UI layout code across several Trezor models and updates type hints, but it does not alter cryptographic signing, transaction parsing, or security checks.

This commit is a straightforward internal code cleanup. It renames a parameter from 'token_address' to 'extra_menu_items' and changes it from a single Ethereum token address string into a generic list of extra label/value pairs. The Ethereum app now passes the token contract address as one item in that list, while other cryptocurrency apps simply pass an empty list. There is no change to user-facing security behavior and no bug fix or vulnerability patch.

This is a routine internal code cleanup. It replaces loose groups of payment-request data (tuples) with named data classes (Refund and Trade) and moves shared helper code into a new file. There is no change to what the device shows or signs, and no security fix or vulnerability is present.

This commit refactors how Trezor hardware wallets display payment requests when no recipient address is provided. Previously, the code always expected a recipient address and would include it in the confirmation screen. Now, it handles cases where the recipient address is missing by either omitting that detail or showing a simpler confirmation. There is no direct evidence this fixes an active security vulnerability; it appears to be a UI robustness improvement.

This commit moves the same on-screen trade-confirmation helper from the non-Bitcoin code block into the common, always-compiled section across four Trezor device layouts. The function itself is not changed; it is only made available in the Bitcoin-only firmware build as well as the full build. There is no direct evidence in the commit that this fixes a security bug.

This update fixes a bug in the Trezor hardware wallet where a specific secure connection protocol (THP) would freeze while the user was entering their PIN to unlock the device. The fix keeps the protocol alive so the connected computer can still exchange basic keep-alive messages (like pings) during unlock, preventing connection timeouts or stalls.

This commit simply adds a new firmware version number (2.9.4) and the list of Trezor device models it supports to a release metadata file. There is no code change, no bug fix, and no security-related content in the diff.

This commit simply bumps a timestamp and a matching minimum data version number used for Ethereum token/chain definitions. There is no code change, no security fix, and no vulnerability introduced.

This commit is purely a documentation update: it moves an existing changelog entry for a Bluetooth test fix ('Fix ble-adv-start without args.') from a draft file into the published prodtest changelog for version 0.3.5. No code was changed, so there is no security issue in this commit itself.

This commit fixes a bug in Trezor hardware wallets where device settings stored behind the PIN lock were not reloaded after the user unlocked the device. The patch adds a call to reload settings from secure storage right after a successful PIN unlock. The included test checks that the auto-lock behavior still works correctly after unlocking. There is no public disclosure or CVE attached to this commit, and the vendor does not explicitly label it as a security fix.

This commit is purely a documentation change: it compiles the release notes for Trezor firmware version 2.9.4 by moving individual changelog fragments into the main CHANGELOG files. No source code, configuration, or executable files were modified, so it cannot introduce or fix a security vulnerability on its own.

This commit simply adds a new digital signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. It is a routine metadata update with no code changes and no apparent security relevance.

This commit is purely a documentation change: it moves five short bug-fix descriptions from individual changelog draft files into the official bootloader CHANGELOG.md for version 2.1.15. No source code was modified, so this commit by itself cannot introduce, fix, or exploit any security issue.

This commit updates pre-built binary files (bootloader and security monitor) for the T3W1 hardware model, along with the matching bootloader hash. The change is presented as a routine chore with no changelog entry. There is no visible source diff or description of what changed inside the binaries, and no security relevance is stated.

This commit is a routine housekeeping change. It updates two project maintenance files so that build directories with names like 'build_debug' are ignored by Git and excluded from code-style checks. There is no change to the actual firmware code, no bug fix, and no security relevance.

This commit fixes a bug where Trezor hardware wallets would not display the intended Red Screen of Death (RSOD) warning when a physical tamper-detection event occurred. The fix reorganizes the tamper interrupt handler so it correctly rebuilds the error information and uses the proper RSOD display path after a tamper event. Without the fix, the device might fail to show the user-visible tamper alert, which could hide that the device had detected a physical attack.

This commit removes a feature in the Trezor hardware wallet's security monitor that enabled an external tamper-detection trigger in production builds. Tamper detection is meant to wipe secrets if someone physically attacks the device. The change suggests the external trigger was either unreliable, risky, or not ready for production, but the commit message gives no details. Without more context, we cannot tell whether this fixes an active security flaw or is just a defensive cleanup.

This commit is a test-only helper update. It extends an automated UI traversal routine in the Python test library so it can also exercise the newer 'flow menu' screens on Trezor hardware. There is no change to device firmware, cryptography, user-facing behavior, or production code.

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. There are no code changes to the actual Trezor firmware, wallet logic, or security behavior. It is a routine maintenance update to keep automated UI tests aligned with the current software output.