Trezor firmware

This commit only refactors a single automated test file for Ethereum transaction signing on Trezor hardware wallets. It extracts duplicated code into a helper function and updates how the test checks for an expected error message. There is no change to the actual firmware, wallet logic, or security behavior.

This change tightens a Stellar cryptocurrency confirmation screen so the amount and asset can no longer be left blank. Previously, the code allowed them to be optional and would silently skip showing the amount if either was missing, which could let a user approve a payment without seeing how much was being sent. The commit makes both values mandatory and always displays them. It is described as a defensive refactor, not a fix for an active bug or reported vulnerability.

This is a build-system maintenance change. It replaces hard-coded guesses about where Cargo places compiled files with a single helper function that walks the directory tree more reliably. There is no user-facing feature change and no security fix or vulnerability.

This commit is a simple bulk rename of an internal feature code name from 'N4W1' to 'N1W1' across the Trezor firmware codebase, build system, tests, and client libraries. It changes only identifiers, comments, strings, and generated protocol-buffer files. There is no functional change and no security relevance.

This commit is a routine German translation update. It changes the wording on a wallet recovery button and refreshes the translation signature file that verifies the translations are authentic. There is no security issue here.

This commit adds a hard limit on how deeply nested Protobuf messages can be when the Trezor device decodes them. Without such a limit, a malicious or malformed message could nest messages inside messages indefinitely, potentially crashing the device or causing other problems. The change caps nesting at 16 levels and adds a test to confirm that deeper nesting is rejected.

This is a routine performance refactor in Trezor's Python library. It replaces a slow, CPU-heavy way of measuring nested protobuf message sizes with a faster approach that builds the message in memory once. There is no indication this fixes a security vulnerability; it is described purely as a speed improvement.

This commit is a routine code cleanup to satisfy the Rust Clippy linter. It removes unnecessary reference symbols (&), rewrites a small match block to assign a value directly, and removes an unused import. There is no functional change and no security relevance visible in the diff.

This commit adds a new security gate inside the Trezor firmware's core operating system. Before this change, any installed mini-program ('applet') could call any internal system function ('syscall'). Now, by default, applets can only call a small, approved list of syscalls, unless they are explicitly granted a new 'unlimited_syscalls' privilege. The built-in 'coreapp' applet is granted this privilege, so it behaves as before. The change is a hardening measure that reduces the damage a compromised or malicious applet could do.

This commit adds a new security permission called framebuffer_access that controls whether a small helper app (applet) running on the Trezor can read from or write to the device's screen memory. Previously, applets could access the framebuffer based only on memory location checks. Now they must also be explicitly granted the framebuffer_access privilege. The change is a hardening/feature addition, not a fix for an active exploit, and it removes an older privilege called assets_area_access that was apparently unused or being replaced.

This commit is a small internal code cleanup in the Trezor firmware's Rust UI layer. It changes how a layout object hands back its result to caller code: instead of returning a copy of the result, it now 'takes' the result away so the same value cannot be retrieved twice. The change was needed because the error type no longer supports being copied (Clone). There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a refactoring to keep the code compiling and to make the API behavior clearer (subsequent calls return None).

This commit is a routine internal code cleanup in the Trezor firmware's Rust/MicroPython bridge. It introduces a dedicated tuple helper module so developers can write tuple conversions more naturally, and removes an older, less ergonomic helper. There is no indication it fixes a security bug or changes security-relevant behavior.

This commit adds build-time safety checks to prevent future Trezor firmware versions from accidentally setting anti-rollback version numbers too high for the hardware storage to handle. If a version were set above the storage limit, the device could either wrongly refuse to boot a valid update, or silently stop enforcing downgrade protection. The fix prevents that mistake at compile time, before any device is shipped. It does not fix an active bug today because all current models are well below the limit.

This commit changes a Trezor factory-testing tool (prodtest) so that PINs sent during NFC backup authentication and PIN setup are padded to a fixed length and encrypted with the Noise XXpsk3 protocol before being transmitted. Previously, the raw PIN was placed directly into the NFC APDU command. The change reduces the risk that someone sniffing NFC traffic could learn the PIN length or the PIN itself in plaintext. It is a defensive hardening improvement in a manufacturing/debug utility, not a fix for an active exploit in end-user firmware.

This commit adds several missing safety checks in low-level hardware code for the Trezor hardware wallet. It prevents reading past the end of a too-short firmware image, avoids odd behavior when asked to read or write zero SD card blocks, ensures a signature buffer is large enough before use, and fixes a debug-message routine that could truncate or mishandle strings. These are defensive fixes; the commit message does not call them security fixes, but missing length checks in embedded code can sometimes be exploited to crash the device or leak nearby memory.

This commit changes the Trezor Python library's collective signing (CoSi) helper so that, by default, it generates random nonces instead of deriving them deterministically from the private key and message. The old deterministic mode is kept only for publicly known development keys, because using it with real secret keys is dangerous: a malicious coordinator could trick the same key into signing the same message twice with different combined nonces, which would leak the private key. The patch itself is a security improvement, not an exploit, but it fixes a latent vulnerability in the library's API design.

This commit refactors how Trezor firmware recognizes external 'definitions' files (the data blobs that describe Ethereum networks and tokens). It splits the old 5-byte header 'trzd1' into a 4-byte magic 'trzd' plus a 1-byte version number. The change is framed by the authors as a necessary preparation for a future signature-quorum change, not as a fix for an active vulnerability. No currently reachable security flaw is present in the diff; the code still only accepts version '1', which keeps the existing 2-of-3 signature requirement.

This change fixes a logic bug in how Trezor handles Solana staking transactions. Previously, the device could ask the user to confirm a staking detail before it had fully verified that the transaction matched a safe, predefined pattern. The fix moves that confirmation check to after all safety checks are complete, so the device only asks for confirmation when it is confident the transaction is a known, legitimate staking flow. This prevents a potentially malicious or malformed transaction from tricking the user into confirming something risky.

This commit adds user-interface support for Tron smart-contract transactions that also move native TRX coins. Previously, the device screen did not show the native TRX amount when a smart contract was involved. Now it can display that amount so the user sees what they are really sending. The change is mostly UI wiring and test data; it does not appear to alter transaction validation or signing logic.

This commit changes how Trezor hardware wallets handle Tron smart-contract calls that include native TRX tokens. Previously, the device did not display or validate the `call_value` field, which means a user could be tricked into sending TRX along with a contract call without seeing it on the device screen. The patch adds a safety check that rejects oversized values and shows the TRX amount during transaction confirmation. It is a defensive fix rather than an exploit.

This commit fixes a bug in the Trezor hardware wallet's Ethereum transaction signing flow. When using SLIP-24 payment requests with ERC-20 token transfers, the device could incorrectly skip the user-confirmation step for the transaction details. The fix ensures that 'clear signing' mode (which bypasses some confirmations) is checked before the payment-request path, so users still see and approve the token transfer details.

This commit only updates translated text strings in Czech, German, Spanish, French, and Portuguese translation files, plus the corresponding translation signature metadata. There are no code changes, no security fixes, and no behavior changes. It is a routine localization sync.

This commit improves the on-screen confirmation experience when creating an advanced Shamir backup on a Trezor device. It adds extra prompts that show the user how many backup groups exist, how many groups are needed to recover the wallet, and the threshold for each individual group. There is no security vulnerability here; it is purely a user-interface improvement to help people verify their backup settings.

This commit is a routine translation update for the Trezor hardware wallet firmware. It only changes user-facing text strings in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signature metadata. There are no code logic changes, no security fixes, and no functional changes to how the device operates.

This commit is a small user-experience fix, not a security patch. Firefox's U2F support sends a special dummy registration request to check whether a security key is present. Trezor previously recognized two such dummy IDs, but Firefox's newer authenticator code uses a third one ('make.me.blink'). Without this change, Trezor would prompt the user to register the device, which is confusing. The fix makes Trezor show a simple 'not registered / already registered' message instead. It does not fix a vulnerability that lets an attacker steal funds or bypass protection.