Trezor firmware

This commit adds user-friendly on-screen labels for wrapping and unwrapping Ether using the popular WETH token contract on several Ethereum-like networks. It does not change transaction security rules; it only makes the device show clearer messages such as 'Wrap ETH to WETH' instead of raw contract data. There is no indication of a vulnerability being fixed.

This commit updates Trezor's Solana off-chain message signing feature from an older version (v0) to a newer version (v1). It changes how messages are packaged and sent to the device: instead of the computer app formatting the message and sending raw bytes, the device now receives a structured message and formats it itself. This is a feature migration, not a fix for an active security bug, but it removes support for the older format and changes the command-line interface. The change is described as following Solana Foundation's direction because v0 was considered flawed.

This commit is a routine version bump from 2.12.3 to 2.12.4 for the Trezor firmware. It only changes the version number in one header file and updates the same version number in translation files, plus refreshes the translation signature metadata. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner could be hidden from the user, allowing an attacker to later seize funds sent to the freshly created account. The fix is purely a user-interface change on the hardware wallet screen, not a change to Solana itself.

This commit adds a new line on the Trezor screen when authorizing a CoinJoin: it now shows the 'Max coordinator fee rate' alongside the existing 'Max rounds' and 'Max mining fee'. This is a user-interface improvement that gives the device owner more information before they approve a CoinJoin session. It does not change any security logic, fee enforcement, or authorization checks; it only displays an extra value that was already part of the authorization message.

This commit fixes a misleading display on Trezor hardware wallets when a user initializes a Solana multisig account. Previously, the device only showed the list of possible signers without showing how many signatures were actually required to approve transactions. This made a 1-out-of-N multisig look like an N-out-of-N multisig, which could trick a user into thinking funds or token operations were safer than they really were. The patch now displays the threshold number (M) so the user sees, for example, '1 of 3 signers required' rather than just '3 signers'.

This update tightens a Solana staking flow in Trezor firmware so that the device now verifies the staking account is owned by the legitimate Stake program before showing the user a friendly confirmation screen. Previously, a crafted transaction with a different owner could slip through the predefined staking prompt, though the Solana network itself would likely reject it. The change also fixes a missing display option in the claim flow.

This commit fixes a bug in how Trezor firmware parses Ethereum transaction data for 'clear signing' of complex smart-contract calls. The parser previously misread arrays of simple structs (e.g., lists of token-swap details) because it assumed every struct element was stored via an offset pointer, which is only true for structs containing variable-length data. With the correct ABI behavior, static structs are now read directly in sequence. The bug could cause Trezor to display wrong values or fall back to blind signing, but it does not leak private keys or directly steal funds. The fix also hardens parsing against malformed empty structs and out-of-bounds reads.

This commit fixes how Trezor firmware parses certain Ethereum transaction data types—specifically arrays of byte blobs (bytes[]) and arrays of strings (string[])—when showing clear signing details on the device screen. Before the fix, the code would follow an offset pointer twice, likely reading the wrong memory location and producing incorrect decoded values. That could cause the Trezor to display misleading transaction details to the user, potentially tricking them into approving a transaction that does what the screen does not show.

This commit removes unused code and unreachable safety checks from the Ethereum clear-signing module. The removed function (parse_uint256_array) was never actually used, and the type-check guards it supported could never be triggered. There is no evidence this change fixes or introduces a security vulnerability; it is a code cleanup.

This is a pure code cleanup: it replaces hard-coded '32' values with a named constant, renames a class from 'Dynamic' to 'DynamicLeaf' for clarity, and renames a variable for readability. The commit message explicitly says 'no behavior change' and there is no functional change visible in the diff.

This commit adds support for signing Stellar Soroban smart-contract transactions on Trezor hardware wallets. It introduces new message types, on-device confirmation screens, and serialization logic for complex contract arguments and authorization trees. The change is a feature addition rather than a bug fix; it does not by itself fix a known vulnerability, but it does expand the attack surface of the Stellar signing flow and includes several security-relevant design choices (e.g., showing externally signed authorizations only on request).

This is a clean internal code rename in the Trezor firmware's Ethereum module. A shared type variable used by two different pieces of code is split into two separate type variables so that a future feature (EthereumSignAuth7702) can use the keychain helper without being incorrectly tied to transaction-signing code. No behavior changes, no bug fixes, and no security issue is present in the diff.

This commit removes built-in, hard-coded display rules for the LI.FI swap/bridge protocol from Trezor's Ethereum 'clear signing' feature. It is a feature cleanup, not a fix for a code vulnerability. The change means Trezor will no longer automatically show friendly LI.FI transaction labels unless the user or wallet later loads an external definition file. The commit itself does not introduce a security bug, but it slightly changes how users verify LI.FI transactions on the device screen.

This commit is purely a test-data update for Trezor's Ethereum 'clear signing' feature. It removes old built-in test fixtures and adds new externally-supplied token/chain definition files so the test suite can exercise how the device handles user-provided definitions. There is no change to firmware, wallet logic, or security-critical code.

This commit only changes a test file for Stellar cryptocurrency transaction signing. It adds a check that the expected signatures stored in test fixtures are mathematically valid, so that future tests don't accidentally treat a bad signature as correct. It does not change the actual Trezor firmware code that users rely on, so it has no direct security impact on devices.

This is a test-only refactoring commit. It changes how Ethereum function signatures are represented in firmware source code (from hex strings converted at runtime to raw byte literals) and updates the corresponding unit test to verify those signatures against Solidity function definitions. There is no runtime behavior change and no security fix or vulnerability.

This commit is a straightforward internal code cleanup. It replaces several direct uses of a lower-level UI helper (`Layout(...).get_result()`) with a simpler wrapper function (`interact_simple`). The behavior described in the comments—specifically that the waiting screen must not start its own ButtonRequest handler—is preserved in the new helper usage. There is no indication this change fixes or introduces a security vulnerability.

This commit fixes a UI lifecycle bug in Trezor firmware. The old `draw_simple()` function started a layout but did not properly wait for it to finish or stop it, which could leave stale UI tasks running ('scoping violations'). The new `interact_simple()` runs the layout to completion and returns its result, ensuring the passphrase prompt is correctly stopped. The security relevance is implied by the commit title and comments, but no explicit security disclosure or CVE is present.

This commit fixes a CI/build script inefficiency. The build script was building the same T1B1 (original Trezor) firmware twice because it ignored the requested build target. The fix makes the legacy T1B1 firmware build run only when the 'firmware' target is explicitly requested, and adjusts the CI workflow to initialize the build environment once and skip the redundant bootloader/prodtest step for T1B1. There is no security vulnerability here—just wasted build time.

This commit only changes user-visible text strings in the Trezor firmware. It updates English translations, removes duplicate layout-specific versions of the same phrase, adds missing periods, and introduces a new description string shown when re-entering a PIN on the Delizia device layout. There is no code behavior change that would affect security.

This commit adds a new optional 'chunkify' setting to Tron transaction signing on Trezor hardware wallets. When enabled, addresses are shown on the device screen in small groups of characters (chunks of 4) instead of one long string, making them easier for users to read and verify. The change also makes chunking disabled by default for Tron sign-transaction screens, whereas some Tron screens previously always chunked addresses. There is no direct security vulnerability in the diff, but any change to how addresses are displayed can subtly affect how well users detect address-rewriting attacks.

This commit only adds a new test data file containing example inputs and expected outputs for Ethereum's EIP-7702 authorization signing feature. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one. The test vectors are public, use a well-known test mnemonic, and are explicitly marked as not requiring a changelog.

This is a purely cosmetic code-style commit. It runs the project's Rust formatter across hundreds of files, changing only how import statements are grouped and how long comments are wrapped. No program logic, security behavior, or functionality was altered.

This commit simply moves a helper function called compact_size from one internal file to another and updates the import statements in files that use it. There is no change to what the function does, no bug fix, and no security impact.