Trezor firmware

This commit fixes a spelling mistake in the legal license text at the top of six source files. The typo 'HMAC_SHALL' is corrected to 'SHALL'. It does not change any program logic, security behavior, or compiled code.

This commit only adds new automated tests for an existing cryptographic handshake protocol called noise_xxpsk3. It does not change the actual security code, fix a bug, or introduce a vulnerability. The tests verify that the protocol works correctly, that tampered messages are rejected, and that keys are wiped after use.

This commit adds a brand-new cryptographic module implementing the Noise_XXpsk3_25519_AESGCM_SHA256 protocol for secure encrypted communication. It is a feature addition with no changelog entry and no accompanying security advisory. The code itself is a clean implementation of a well-known cryptographic handshake, but because it is new code handling private keys, pre-shared keys, and AES-GCM encryption, it is security-relevant by nature. There is no direct evidence in the commit or supplied references that this fixes a known vulnerability or introduces a bug.

This commit fixes several minor issues in a cryptographic module used for secure device communication. The changes include preventing undefined behavior when copying from NULL pointers, zeroing out sensitive key material after use, and properly returning errors when encryption fails. These are defensive hardening fixes rather than a clear, exploitable vulnerability.

This commit is a simple rename of the cryptographic module from 'noise' to 'noise_kk1' across file names, function names, constants, and build scripts. No security behavior changes are visible in the diff. It is a code-maintenance refactor, not a security fix.

This commit fixes a build problem in Trezor's firmware. The code used a very common filename, version.h, which could accidentally pull in the wrong file from another software package during compilation. The fix creates a symlink with a more specific name, firmware_version.h, and uses that instead. There is no direct evidence this is a security vulnerability; it appears to be a build reliability fix.

This is a minor build cleanup. A developer added a compile-time branch so that when neither the Optiga nor Tropic security chips are used, the 'strong' random-number wrapper simply calls the normal random-number function and returns. The only reason for the change is to silence a compiler warning about an unused variable. There is no functional security change.

This commit changes how Trezor devices display Ethereum transactions when someone sends ERC-20 token approval or transfer calls that also include native ETH. Previously, the device might not clearly show the attached ETH, so a user could unknowingly approve sending tokens plus real ETH. The patch makes the device surface that native ETH amount on the confirmation screen. It is a defensive fix that improves transparency rather than introducing a vulnerability.

This commit is a routine feature update for Trezor's Ethereum 'clear signing' feature. It adds human-readable names for more DeFi and staking providers (like Lido, Morpho, Kiln) and makes the address lookup aware of which blockchain network (chain ID) an address belongs to. There is no security vulnerability or bug fix here.

This commit adds an optional user-interface feature for Solana transactions on Trezor hardware wallets. When enabled, long Solana addresses are shown on the device screen in smaller groups of characters (chunks of 4) instead of one long string, making them easier for users to read and verify. There is no indication this change fixes a security vulnerability; it is a usability improvement.

This commit updates the Trezor firmware's Evolu (delegated identity) registration signing feature so that the device now includes a 'rotation index' in the signed registration request. The rotation index tells the Quota Manager which version of the device's delegated identity key was used. The signature format was also bumped from V1 to V2 by adding the rotation index into the signed data. This is a feature enhancement, not a fix for an obvious security vulnerability, but it touches cryptographic signing and identity-key rotation, which are security-sensitive areas.

This change moves some internal test-only Ethereum transaction display definitions from being permanently added to a global list to being generated on demand only when the device is running in debug/test mode. It is a memory-footprint and code-hygiene cleanup, not a fix for an exploitable security bug. There is no indication it addresses a vulnerability.

This commit simply removes a single unit test from the Trezor firmware test suite. The test covered Ethereum 'clear signing' formatting logic, and the commit message says it is being dropped because it should be covered by device tests instead. No production code was changed, so this does not introduce or fix a security vulnerability by itself.

This commit adds two new ways to display Ethereum transaction details on a Trezor screen: a 'raw' formatter that shows values as-is (numbers, text, or hex bytes) and a 'date' formatter that turns a Unix timestamp into a readable date. It also wraps some existing parsing and display steps in try/except blocks so failures are logged and re-raised. There is no direct evidence this fixes an active security bug; it looks like a feature addition for clearer transaction signing.

This commit adds support in Trezor's Ethereum 'clear signing' feature for displaying array (multi-value) fields on the device screen. It also fixes a minor display quirk where booleans were being treated as numbers. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a feature improvement with some defensive hardening against malformed display definitions.

This commit adds a new optional field to Trezor's Ethereum clear-signing protocol that lets a token amount be tied to a fixed contract address rather than pulled from transaction data. It is a feature addition, not a bug fix, and there is no evidence in the commit that it addresses a security flaw. The change does not appear to introduce an obvious vulnerability, but it slightly expands the attack surface by adding another way token addresses are resolved.

This commit only adds test code for Trezor's Ethereum clear-signing feature. It introduces debug-only test descriptors, unit tests, device tests, and expected screen snapshots. There is no change to production behavior or any fix for a security issue.

This commit fixes a small Rust UI bug in Trezor's 'Caesar' firmware layout. When a user viewed an 'info' page during a confirmation prompt, the device previously failed to return the expected 'INFO' response and instead threw a type error. The patch adds the missing case so the info page is handled correctly. This is likely a user-experience or defensive bug fix rather than a critical security vulnerability, but it could affect how device confirmations behave.

This is a minor test-only adjustment for the Caesar user interface layout. It changes a test helper so that it only tries to open the menu on the last page of a multi-page screen, because earlier pages do not have a menu/info button. There is no change to production firmware behavior or security.

This commit is a minor user-interface polish change. After a user changes the auto-lock timeout setting on a Trezor device, the device now returns to the dedicated Auto-Lock menu instead of the broader Security menu. It does not change any security policy, cryptographic behavior, or data handling. The accompanying test updates simply expect the new screen.

This commit adds support for a new Tron blockchain transaction type called WithdrawBalanceContract, which lets users claim their voting rewards. It also improves the on-device confirmation flow for claim transactions so the device warns and shows the owner address when the transaction is being signed on behalf of a different account. There is no indication of a security vulnerability in the change itself; it appears to be a normal feature addition with stronger user confirmation.

This commit adds support for a new Tron blockchain operation called 'WithdrawBalanceContract' (claiming voting rewards). It is a feature addition: new message types, generated code, translations, and a test fixture. There is no indication of a security bug or vulnerability fix in the diff.

This commit changes how Trezor hardware wallets derive TRON addresses. Previously, the code loaded the private key into Python memory and computed the public key from it. Now it uses a precomputed public-key hash already available from the keychain. This is a defensive hardening change that reduces the chance of private-key exposure in the Python layer, but it does not by itself fix a known exploitable vulnerability.

This commit fixes a visual glitch on the Trezor T3W1 device where the device menu would visibly jump or flicker when it refreshed. The fix preserves the menu's current scroll position across refreshes by passing an extra offset value through the UI API. There is no indication this change addresses a security vulnerability.

This is a code cleanup (refactor) for the device menu on a specific Trezor hardware wallet model. It changes how menu actions are represented internally (from numbers to named strings) and simplifies how the menu decides which submenu to show next. There is no indication this fixes a security bug or introduces a vulnerability.