Trezor firmware

This commit adds experimental support for a new Ethereum feature (EIP-7702) that lets an account temporarily delegate control to a smart contract. The change is feature work, not a bug fix, and includes several safety guardrails: it is blocked unless experimental features are enabled, requires relaxed safety checks for authorizations (but not revocations), rejects cross-chain delegation, and only allows known delegate addresses. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit is a minor cleanup in Trezor's Python test and command-line code. It stops treating Ethereum transaction signatures as plain tuples (v, r, s) and instead uses a named data class (SignTxResult). The only functional code change is converting the data class back to a tuple in one place so existing callers keep working. There is no security bug being fixed here.

This commit tightens access controls in the older Trezor firmware (legacy) for a privacy feature called CoinJoin. Previously, after a host app was pre-authorized, any next message could consume that authorization. Now only specific message types (SignTx and GetOwnershipProof for preauthorization; GetAddress, GetPublicKey, and SignTx for an unlocked path) can use it. The vendor describes this as defense in depth, not a fix for a directly reachable attack, because the host that could trigger it already has related access. Still, without the change, a preauthorization could let GetAddress or GetOwnershipId touch the CoinJoin account without showing the user the usual confirmation screen.

This commit fixes a bug in how the Trezor hardware wallet builds Nostr event signatures. Previously, special characters in the event content and tags (like quotes, backslashes, tabs, and newlines) were not properly escaped when creating the JSON string that gets signed. This could cause the device to compute a signature that does not match what standard Nostr software expects, or in some cases could allow a malicious app to craft content that changes the meaning of what the user approved on screen versus what is actually signed. The fix adds proper JSON string escaping for both the main content and tag strings.

This commit fixes a bug in the older Trezor firmware (legacy) where a CoinJoin signing session would not be properly aborted if the requested coin name did not match the one in the prior authorization. Before the fix, the device sent an error message but continued processing, which could allow a malicious or mismatched transaction to proceed. The fix adds an explicit abort and return so the signing stops immediately, matching the behavior of newer Trezor firmware (core). The commit message downplays the practical risk, noting an attacker could not gain more than from a legitimate CoinJoin on the authorized coin.

This commit removes an Ethereum feature called EthereumSignAuth7702 from the Trezor firmware and related software. It deletes the message types, the signing handler, the command-line tool, and the tests. The commit message says this feature will later be merged into EthereumSignTxEIP1559. There is no security fix here—this is a routine cleanup/refactoring change.

This commit adds validation checks to Trezor's cryptocurrency wallet code to make sure private and public keys are mathematically valid before they are used. Previously, some code paths accepted invalid keys (such as a private key of zero, a private key equal to or larger than the curve order, or a public key that is not actually a point on the elliptic curve). Using invalid keys could in theory lead to incorrect cryptographic operations or weaken security. The change also fixes a missing check for unknown curve names during deserialization, which could have caused the code to read from a null pointer.

This update fixes a display bug in Trezor's Solana token-transfer confirmation screen. When a token transfer uses Solana Address Lookup Tables (ALTs) to refer to the token mint or the owner account, the device previously showed the lookup-table address as if it were the real account address. That could trick a user into approving a transfer they did not fully understand. The fix makes these cases fall back to a more cautious, generic confirmation screen that clearly marks ALT references.

This commit only updates test data files for Ethereum EIP-7702 (account abstraction) signing. It renames a test field, adds more test cases, updates expected error messages, and adds mainnet transaction test vectors. There are no changes to the actual firmware or production code, so it does not introduce or fix a security vulnerability in the shipped product.

This update fixes a security gap in Trezor's handling of Solana staking. Previously, if someone set up a stake account with a future unlock date (a 'lockup') using values that Trezor's normal flow didn't expect, the device would silently approve the transaction without showing those lockup details on screen. That could trap a user's funds until a far-future date. The fix makes Trezor fall back to a more detailed, generic confirmation screen whenever a lockup is present, so the user can see and approve the terms explicitly.

This commit only updates a bundled cryptographic library (secp256k1-zkp) from version 0.7.0 to 0.7.1. The actual code change is a one-line update to the submodule pointer. The commit message does not describe any security fix, and no security-relevant details are visible in the diff itself.

This commit removes a single line from the project's Git submodule configuration. It stops pinning the libtropic submodule to the 'develop' branch, meaning the project will now use the submodule's default branch (likely 'main' or 'master'). There is no code change, no bug fix, and no direct security issue visible in the diff itself.

This is a hardening change for the random number generator inside Trezor hardware wallets. It makes sure that temporary memory holding secret random values from the Optiga and Tropic security chips is wiped immediately after use, rather than only once at the end. It also fixes a subtle edge case where a buggy Tropic chip call could leave old Optiga randomness in the temporary buffer, potentially weakening the final random output.

This commit adds a new Rust-based on-screen menu component for the Trezor hardware wallet's Bolt user interface. It is a straightforward feature implementation and does not fix or introduce any obvious security issue. The component is not yet wired into any user-facing flows.

This commit upgrades the third-party STMicroelectronics NFC middleware (RFAL) inside Trezor firmware from version 4.0.2 to 4.2.0. The stated reason is to add a 'presence check' in the ISO-DEP layer, which helps the device verify that an NFC card is still nearby during a transaction. The diff is almost entirely a bulk import of ST's updated library files, so the actual security-relevant changes are not visible in the commit itself. There is no Trezor changelog entry and no CVE or advisory referenced.

This commit only changes the data format definitions (protobuf messages) used to talk to a Trezor hardware wallet. It adds new optional fields for an upcoming Ethereum feature called EIP-7702, which lets an account temporarily act like a smart contract. The commit does not contain any actual signing logic, user confirmation screens, or security checks. Because it is just a protocol definition update, it does not by itself create a vulnerability, but it is a building block for future code that will handle these authorizations.

This commit only changes test data and expected screen fingerprints for Trezor's Ethereum EIP-7702 signing tests. It replaces one test case that used a nonce of 0 with the same scenario using a nonce of 67, because the real-world protocol rule requires the tuple nonce to be non-zero. No production firmware code is modified, so this commit does not fix or introduce a security vulnerability in shipped devices.

This commit only cleans up test code by removing an unused 'session' argument from a helper function used in automated tests. It does not change the actual Trezor firmware or any code that runs on the device, so it has no security impact for users.

This commit adds a progress bar feature for firmware updates sent to the nRF wireless chip inside Trezor devices. It threads a callback function through the upload code so the bootloader can show how much of the image has been transferred. The existing public syscall entry point is deliberately left unchanged, so normal app behavior is unaffected. There is no security fix or vulnerability here.

This commit only adds a plain-English comment explaining an existing function that estimates how long a random-number generation call takes. No code behavior changed, and nothing was fixed or added that affects security.

This commit adds compile-time guards to prevent an intentionally insecure random-number generator from being accidentally included in firmware that runs directly on Trezor hardware. It does not fix an active bug, but it adds safety rails so a future build misconfiguration cannot silently ship weak randomness to real devices.

This commit is a routine build cleanup. It moves a header file to the correct folder and updates two source files to include it from the new location. There is no security-relevant change here.

This is a routine build cleanup in the Trezor firmware kernel. It removes an unused Rust library dependency called 'trezor_lib' and replaces it with a reference to another module ('io') to ensure certain Rust symbols are still included during linking. There is no indication this change fixes or introduces a security vulnerability.

This commit is a straightforward internal code reorganization. It moves several low-level hardware communication modules (NRF radio, SMP firmware-update protocol, IRQ utilities, and C-string helpers) into different Rust crates so the project structure is cleaner. No security vulnerability is introduced or fixed; it is purely a refactoring change.

This commit is a build-system cleanup for the Trezor firmware's Rust code. It changes how the 'emulator' feature flag is passed between different software components. The firmware project no longer supports the emulator feature (which makes sense because real firmware runs on hardware, not an emulator), while the bootloader, prodtest, and core Rust library now propagate the feature more consistently. There is no indication of a security vulnerability in this change.