Trezor firmware

This commit only adds new automated tests for Trezor's Ethereum 'clear signing' feature. It includes a test case for an Aave multi-call transaction, a matching test data blob, and expected screen snapshots for different device models and languages. There are no changes to the actual firmware code that runs on the device, so this commit does not introduce or fix a security vulnerability.

This commit is purely scaffolding for a new Ethereum clear-signing feature. It adds a new data type (FORMATTER_CALLDATA), two new optional fields (callee_path and selector) to message definitions, and two new user-facing text labels ('Subcall' and 'Subcall to'). There is no actual implementation of parsing, validation, or display logic here, and no security vulnerability is visible in the diff.

This commit fixes a user-interface bug in Trezor's Ethereum 'clear signing' flow where the transaction's native ETH amount could be shown twice on the device screen. The old code tried to avoid duplication by checking whether an 'AmountFormatter' field was present, but that check missed cases where the same amount was rendered by other field types. The new code compares the actual rendered strings and suppresses the summary amount only when it exactly matches a field already displayed. There is no security vulnerability here; it is purely a display-quality fix.

This commit only adds new data structures and an enum value for a future 'enum formatter' feature in Trezor's Ethereum clear-signing support. It does not change any existing behavior, add parsing logic, or fix a bug. There is no security issue visible in this change.

This commit adds a new display formatter for Ethereum clear signing. It lets a transaction descriptor map numeric enum values (like 1 or 2) to human-readable labels (like 'stable' or 'variable') on the Trezor screen. The change is purely additive and includes tests. There is no indication it fixes a security bug or introduces a vulnerability; it is a feature implementation.

This commit only adds a new automated test case for an existing Ethereum transaction display feature. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. It is purely a test-data addition.

This commit adds a new Trezor firmware feature called 'clear signing' for nested Ethereum calls. It lets the device understand when a transaction wraps another contract call (like a router or multicall) and tries to show the user readable details about the inner call instead of just a blob of hex. The change is a feature addition with built-in safeguards: nested parsing is limited to one level, ambiguous fields like sender and value are blocked inside nested calls, and failures fall back to showing raw hex rather than aborting the whole transaction. There is no indication in the commit that this fixes a known security bug; it reads as a defensive new capability.

This commit is a test-only addition for Trezor's Ethereum 'clear signing' feature. It adds new test cases and makes a small production-code tweak so that enum display-formatters can accept byte values (converted to integers). The change is not described as a security fix, and the production change is minor and defensive: it broadens accepted input types rather than fixing a crash or bypass. There is no evidence of a disclosed vulnerability or exploit.

This commit is a code-quality cleanup that changes many function parameters from signed integers (`int`) to unsigned size types (`size_t`) where only non-negative lengths or sizes make sense. It also removes some now-unnecessary negative-value checks and adjusts callers/tests accordingly. The change is defensive: using `size_t` prevents accidental negative lengths from being interpreted as huge positive values, which can cause memory corruption or information leaks. The commit itself does not claim to fix a specific vulnerability, and no external security advisory is supplied.

This commit only changes the on-screen text labels shown when a Trezor device asks the user to confirm a Stellar blockchain authorization. It renames labels from formats like 'Authorization 2' and '1-2-1' to 'Authorization #2' and '#2.1.1'. There is no security vulnerability or fix here; it is a user-interface clarity improvement.

This commit adds a new Trezor feature that lets users sign Stellar Soroban smart-contract authorization entries. The device now supports a new message type where it derives the user's Stellar address, shows confirmation screens, and produces an Ed25519 signature over a protocol-defined authorization payload. The change is a feature addition rather than a bug fix, and the signing flow includes user confirmation steps.

This commit only adds new automated tests for signing Stellar Soroban authorizations. It does not change any production firmware, wallet logic, or cryptographic code. There is no security vulnerability here.

This commit is a straightforward code cleanup: it moves several Stellar Soroban serialization helper functions from an operation-specific file into a shared writers module so both transaction signing and standalone authorization signing can use the same code. No behavior changes, bug fixes, or security fixes are visible in the diff.

This commit is a straightforward code cleanup: it moves helper functions for formatting Stellar Soroban smart-contract values and showing confirmation screens from one file to another shared file. No security behavior changes are visible in the diff. The only functional tweak is narrowing an exception handler from a broad 'except Exception' to 'except OverflowError' when formatting timestamps, which is a minor hardening improvement, not a vulnerability.

This commit updates Trezor's Stellar/Soroban smart-contract support to match a newer Stellar protocol version (Protocol 27). It renames the credential type from the older SOROBAN_CREDENTIALS_ADDRESS to SOROBAN_CREDENTIALS_ADDRESS_V2 and updates the related field name from address to address_v2 across the firmware, Python library, Rust client, and tests. The older credential type is intentionally no longer supported. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a routine protocol compatibility update.

This commit is a code cleanup in the Trezor hardware wallet's user interface. It replaces hard-coded colon punctuation (like 'Amount:') with a helper function called with_colon that adds the colon in a translation-friendly way. There is no security issue here.

This commit adds a new feature to Trezor's Ethereum 'clear signing' system that lets wallet definitions extract a slice of bytes from a numeric parameter. For example, a 32-byte number that secretly packs an address into its last 20 bytes can now be sliced so the device shows only the real address. The change is described as a feature, not a bug fix, and there is no vendor statement that it fixes a security vulnerability. It does reduce one real risk: users could otherwise be tricked into approving transactions where hidden extra bits in a number change the meaning of what they see on screen.

This commit adds a new user-facing safety feature for Trezor hardware wallets when signing Ethereum transactions. If the user chooses to view all the raw transaction data (calldata), the device will now also show a final cryptographic hash (digest) of that data, based on a community standard called ERC-8213. This helps users verify that what they saw on screen matches what is actually being signed, reducing the risk of hidden malicious changes in very long data fields. It is a defensive improvement, not a fix for an active bug or vulnerability.

This commit only changes a test data file. It removes duplicate 'skip_models' entries from Ethereum EIP-7702 test fixtures so that the T2T1 model is no longer excluded from these tests. There is no change to firmware code, no security fix, and no user-facing behavior change.

This commit adds support for signing Ethereum EIP-7702 authorizations and revocations on Trezor hardware wallets. EIP-7702 lets an Ethereum account temporarily delegate control to a smart contract. The code adds a new signing workflow, user confirmation screens, and command-line support. It is a feature addition, not a fix for a known vulnerability. The main security consideration is that authorizing delegation is a powerful operation, so the code requires users to disable strict safety checks and confirm on the device, while revocation remains allowed under strict checks.

This commit only edits changelog text. It adds a more precise description of an already-released Ethereum feature (EIP-7702 support) and removes an older, less accurate changelog line. No code, transaction logic, or cryptographic behavior is changed, so there is no security issue in this commit itself.

This commit adds support for more Ethereum data types in Trezor's clear signing feature. It introduces parsing for signed 160-bit integers (int160) and fixed-size byte arrays of various lengths (bytes4, bytes8, bytes16, bytes20, bytes32). The code also refactors existing parsers to use shared factory functions. The changes are primarily feature additions with built-in validation checks, and there is no direct evidence in the commit of a security vulnerability or fix.

This commit updates the Trezor Ethereum 'clear signing' feature so that when a known DeFi contract (like 1inch or Uniswap) is recognized, the device screen shows the provider's human-readable name (e.g., '1inch Aggregation Router V6') instead of just a raw address or a generic vault label. It also updates some URL comments to point to the community ERC-7730 registry rather than Ledger's copy. There is no obvious security vulnerability in the change; it is a user-experience improvement for transaction clarity.

This commit adds a new optional 'provider_name' field to the data structure used for Ethereum 'clear signing' on Trezor devices. When a provider name is supplied, the device will show that name instead of the usual recipient address lookup during transaction confirmation. The change itself is a feature addition, but it creates a new channel where a connected computer could tell the Trezor screen to display an arbitrary label for the recipient. There is no evidence in the commit that the input is validated, length-limited, or checked against the actual blockchain address, which could allow a malicious or compromised host application to mislabel a transaction recipient.

This commit fixes two functions in Trezor's base58 code that build temporary memory buffers using a user-supplied length. Before the fix, a negative length value was not rejected. On systems where negative signed integers are treated as very large unsigned values, that could cause the device to allocate a huge buffer or corrupt memory, potentially crashing the device or enabling further attacks. The fix adds simple checks to reject negative lengths.