Trezor firmware

This commit is a routine cleanup of unused French font data. It removes the degree symbol (°) glyph and its spacing rules from 23 font files because that character is no longer needed for French translations. There is no code change, no security fix, and no user-facing behavior change beyond slightly smaller font files.

This commit is a user-interface refactor for the Trezor hardware wallet's device menu. It changes how the menu receives updated information (like Bluetooth connection status) so the menu can refresh itself without closing and reopening. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a code-quality and user-experience improvement.

This commit fixes a bug in how Trezor's Solana app counted account roles inside a transaction. In release builds, safety checks were removed, so a malformed transaction could trick the device into showing a signer account as read-only on screen. The device would not actually sign anything harmful, because the Solana network would reject the bad transaction anyway. The fix replaces the removed checks with proper error handling and corrects one rule: every transaction must have at least one writable signer to pay fees.

This commit only updates test data files (binary .dat fixtures and a UI test fixtures JSON file) to refresh timestamps. The change is explicitly described as avoiding CI test failures when a version number is bumped during release. There is no firmware code change, no user-facing behavior change, and no security relevance.

This commit is a routine cleanup that removes duplicate or unnecessary function and variable declarations across many source files. It does not change how the device behaves, process secrets, or handle user data. There is no indication this is a security fix.

This commit is a documentation-only changelog update for the Trezor firmware release 2.12.5. It lists several security fixes that were already made in earlier code changes, including protections for Ethereum swaps and staking, Solana token display and stake lockup confirmation, and Stellar network and signer details. The commit itself does not change any firmware code, but it confirms that the vendor considers these items security-relevant for the release.

This commit moves a special memory section named '.bootloader' from one flash memory region to another in the firmware's build instructions (the linker script). The bootloader section likely contains data used to verify or locate the device's bootloader. Reordering linker sections can affect how the firmware is laid out in memory, which in rare cases can have security implications (for example, if it changes what code runs first, where secrets live, or how integrity checks are computed). However, the commit message gives no explanation of why the change was needed or whether it fixes a security problem, and the diff alone does not show a clear vulnerability.

This commit removes built-in human-readable display definitions for 1inch and Uniswap swap transactions from Trezor's Ethereum clear-signing feature. Without these definitions, Trezor devices will likely fall back to showing raw contract call data for those transactions, making it harder for users to verify what they are signing. It is a feature-removal change, not a direct code vulnerability, but it weakens a security-relevant usability safeguard.

This is a code cleanup that makes two bootloader screens slightly smaller and easier to read. It does not change what the device does or how it behaves, and it does not fix any security bug.

This commit fixes a bug in the Trezor hardware wallet's Rust UI code that splits text into chunks for display. The old code used byte positions instead of character positions when handling non-ASCII text (like accented letters or non-Latin scripts). This could cause the device to crash with a panic when trying to display certain international characters, because Rust would reject a slice that cut through the middle of a multi-byte character. The fix makes the chunking logic respect character boundaries. There is no direct evidence in the commit that this is exploitable as a security attack, but any device panic during rendering of user-facing text is at minimum a denial-of-service concern.

This update fixes a flaw in how Trezor handled certain Monero 'sweep' transactions. In a sweep, the device normally skips checking whether the change address truly belongs to the user, because the change output is supposed to carry zero coins and go to a random address. A malicious computer or wallet software could have reused that unvalidated change address for an output that actually holds money. The device would then treat that money as change and lock it with a key the user might not control, effectively freezing or misdirecting funds. The fix rejects such transactions unless the address is the user's own primary address, where the math happens to be safe either way.

This commit fixes a build failure that occurred when compiling Trezor firmware with the --debug option. It adds explicit references to the 'sys' Rust module so the linker includes necessary symbols such as the panic handler. There is no indication this change addresses a security vulnerability or runtime behavior in release builds.

This commit adds support for a new Stellar blockchain feature called delegated authentication (CAP-71-01 / Protocol 27). It lets an account authorize a transaction through a chain of delegated signers. The device now recognizes and serializes these delegate chains, but when showing the transaction to the user it only displays the top-level authorizing address, not the individual delegates. This is a normal feature addition; there is no direct evidence in the commit of a security vulnerability, though any new signing path deserves careful review.

This commit is a code cleanup: it moves the Rust panic handler from several individual firmware components into a single shared system crate. A panic handler is the code that runs when something goes seriously wrong inside the device software. The change does not add new functionality or fix a security bug; it just makes the panic handling code live in one place instead of many. The release builds of Trezor firmware do not even use this handler because they are configured to abort immediately on panic.

This commit is an internal user-interface refactor for Trezor firmware. It changes how on-screen menus are built so that each menu entry can carry an 'intent' (standard or danger) and can return arbitrary values, instead of only supporting a fixed cancel button. The commit message and diff show no new user-facing behavior; existing cancel buttons are converted into a new 'cancel leaf' abstraction. There is no direct evidence this introduces a security vulnerability, but any refactor that touches workflow cancellation paths deserves a careful look to ensure users can still abort dangerous actions.

This commit fixes a build-time race condition in the script that generates a list of internal string identifiers (called 'qstrs') used by the Trezor firmware. Previously, the generator could read a generated translation file while it was being updated, potentially producing an inconsistent list. The fix makes the generator read translation string names directly from the source translation file instead of from a generated file, and also excludes generated files from the grep search. This is a build-system reliability fix, not a runtime security vulnerability in the device itself.

This commit is a routine synchronization of translated user-interface text for the Trezor hardware wallet. It only changes wording in Czech, German, Spanish, French, and Portuguese translation files, plus the corresponding translation signature metadata. There is no code change, no security fix, and no functional behavior change.

This is a routine feature-flag plumbing change for an upcoming NFC hardware feature. It exposes a new USE_NFC constant in Python code and disables advertising NFC capability to host software until the NFC driver is considered stable. There is no security bug or vulnerability in the diff.

This commit improves how the Trezor hardware wallet displays certain Stellar token transactions on its screen. Previously, some token transfers looked like confusing generic contract calls. Now, for two specific vetted tokens (SolvBTC and xSolvBTC), the device will show a friendly token transfer screen. This is a user-interface improvement based on a hardcoded trust list, not a fix for a code execution or theft vulnerability. The change does not alter what transactions the device will or won't sign.

This is a code cleanup (refactor) in the Stellar cryptocurrency support. It replaces an older way of describing tokens on screen with a new internal data structure, but explicitly keeps the same user-visible behavior: every token is still shown with seven decimal places. The change also adds a test confirming that for the native Stellar asset (XLM), any code or issuer supplied by a host computer is ignored, preventing a host from mislabeling XLM as another asset. There is no indication this fixes an active security bug; it is preparation for future SEP-41 token support.

This commit updates a factory-testing tool (prodtest) used with Trezor hardware wallets. It swaps a randomly generated test key for a fixed, hard-coded test keypair and adds a check that the public key reported by an NFC backup card matches the public key in the card's certificate. The change is in a production-test utility, not normal user firmware, and the hard-coded key appears to be a test fixture rather than a live secret. The added certificate check is a security-hardening step, but the commit is partial: it references a new noise_xxpsk3.c source file and a new library API without showing the implementation.

This commit changes how Trezor hardware wallets handle a new Ethereum feature called EIP-7702, which lets users temporarily delegate control of their account to another smart contract. Previously, Trezor only allowed this delegation if the user lowered their safety settings. Now, it allows delegation under the strictest safety settings, but only for a pre-approved list of delegate addresses. Revocation (removing a delegate) was already allowed under strict settings and remains allowed. The change is framed as adding 'strict safety checks' rather than removing protections entirely.

This commit adds support for recognizing one more Ethereum smart-contract account type (Simple7702Account) when signing EIP-7702 delegation authorizations on Trezor hardware wallets. It is a small feature addition that updates a known-address lookup table and adds matching test vectors. There is no indication it fixes a security bug or introduces a vulnerability.

This update fixes a logic flaw in Trezor's Ethereum signing code. When a user was doing an ERC-20 token swap using a SLIP-24 payment request, the device could also be instructed to send native ETH at the same time. That combination is not expected in a normal token swap and could let an attacker trick the user into authorizing an unintended ETH transfer alongside the token swap. The fix now rejects such transactions outright.

This commit only adds a new automated test case for signing an Ethereum ERC-20 token transfer using a SLIP-24 payment request. It does not change any production firmware code, so it cannot introduce a security vulnerability or directly fix one in shipped software. The change is purely in the test suite and its recorded expected screen outputs.