Trezor firmware

This commit fixes a UI wording mix-up on Trezor devices when a user enters a PIN that doesn't match. Previously, the title and description in the 'PIN mismatch' popup were swapped, which could briefly confuse the user about what went wrong. There is no evidence this affects security beyond a minor user-experience issue.

This commit is a user-interface tweak for the Trezor hardware wallet's Caesar layout. It replaces a static title label with a scrolling 'Marquee' text effect on the homescreen confirmation screen, so long device labels remain readable. There is no security-relevant change here.

This commit is a straightforward user-interface string refactor. It moves the colon that appears after labels like 'Account:' and 'Derivation path:' out of the embedded Rust translation strings and into the Python code that calls the address-details screen. There is no security-relevant change in behavior—only where the colon is appended.

This commit changes the Trezor hardware wallet's PIN entry screen so that long prompt messages scroll horizontally (like a marquee sign) instead of being cut off. It is a user-interface improvement to handle longer text, such as wipe-code prompts. There is no security vulnerability visible in the code change.

This commit fixes a layout bug in the PIN entry screen on Trezor's Eckhart hardware model. Previously, the area showing how many PIN attempts remain was given a fixed width of 85 pixels, which could be too narrow for some languages and cause the text to be cut off or poorly displayed. The patch now dynamically measures the actual text width and reserves space accordingly, with a small gap between the prompt and attempts text. There is no direct security vulnerability here; it is a UI correctness and localization improvement.

This commit is a large internal refactor of the Trezor firmware's third-party application loading system. It replaces the old ELF-based app loader with a new 'app_arena' subsystem that uses a custom binary format, Merkle-tree header verification, and ML-DSA-44 root-of-trust signatures. The change is explicitly marked as a feature ('feat(core): introduce app_arena') with '[no changelog]' and contains no vendor statement that it fixes a security bug. It appears to be a planned architectural redesign, not a security patch.

This commit only adds new unit tests for an existing Ethereum clear-signing decoder. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one directly. The tests document how the decoder currently handles various Ethereum ABI data shapes and which malformed inputs it rejects.

This commit adds support for a new Stellar blockchain feature: creating smart contracts (contract deployment) on Trezor hardware wallets. It extends the messages, layouts, serialization, and tests so users can review and sign Stellar 'create contract' transactions and related authorization entries. There is no indication of a security vulnerability in the change itself; it is a feature addition with explicit user confirmation steps and deliberate exclusions of unsupported variants.

This commit is a routine internal code cleanup in the Stellar cryptocurrency support of Trezor firmware. It renames and moves helper functions, extracts reusable pieces, and adds tests. There is no change to user-visible behavior or security boundary, and no security issue is apparent.

This change updates how Trezor devices decide whether downloaded Ethereum token/chain definition files are too old to trust. Previously there was one global cutoff date; now each definition format version has its own cutoff. This is a maintenance and correctness improvement, not a fix for an active security bug. It reduces the chance that a future format version could accidentally accept stale or incompatible definition data.

This commit updates the Trezor One (legacy firmware) to use version 2 of the external Ethereum token/network definition format. The key change is that legacy firmware now requires only one valid signature instead of two, and explicitly rejects the older version 1 format. This is a feature update to align legacy devices with the newer definition format, not a fix for an active security bug. The change is documented and includes tests verifying that version 1 definitions are rejected on legacy firmware.

This commit is a code cleanup that moves a small piece of boot-header parsing code out of an STM32-specific folder so it can also be used in emulator and test builds. It changes function arguments from raw flash addresses (uint32_t numbers) to generic pointers, and fixes one accidental use of a security-boolean value where a null pointer was intended. The commit message and diff show no intended behavior change on real devices.

This is a build-system-only change that moves where the NFC feature flag is defined so the emulator compiles correctly. It does not change any runtime behavior, user-facing functionality, or security logic.

This commit fixes a grammar typo in two code comments/docstrings, changing 'Receive a BLE events' to 'Receive a BLE event'. It does not change any executable code, behavior, or security properties.

This commit only changes how a command-line tool prints information about secure-monitor firmware headers. In non-verbose mode it now shows the device model and version instead of dumping every header field. There is no change to security checks, cryptography, or firmware behavior.

This commit adds a runtime check (assert) that ensures a UI function for confirming on-screen properties is never called with an empty list. It also changes the expected input type from a generic iterable to a sequence and converts a couple of generator expressions into lists. The commit message explicitly says it will not affect production builds, because assertions are typically stripped from production firmware. There is no direct evidence this fixes an active security bug; it appears to be a defensive hardening measure for development/debug builds.

This commit fixes a build-time tooling bug in Trezor's firmware build helper. When creating a combined firmware image, the tool was filling unused gaps between sections with 0x00 bytes. One specific gap (the UCB region) is erased by the bootloader on first boot. Because erased flash reads as 0xFF, the device would no longer match the original image after its first boot, causing factory verification to fail. The fix makes the tool fill that gap with 0xFF instead, so the image stays identical after the device boots. This is a manufacturing/verification bug, not a security vulnerability that can be exploited by an attacker.

This commit turns off an internal performance cache for BIP39, the system that converts a recovery seed phrase into cryptographic keys on Trezor hardware wallets. Disabling a cache is usually a defensive change: it can prevent sensitive seed-derived data from lingering in device memory longer than necessary. However, the commit gives no explanation, changelog entry, or linked security report, so we cannot tell whether this fixes a known vulnerability or is just a precautionary hardening measure.

This is a minor bug fix in the Trezor bootloader. When wiping the device, if a step failed, the bootloader always reported the same generic error message ('Could not read BLE status') even when the actual failure was something else, such as failing to erase stored data or issue a Bluetooth command. The fix makes the bootloader report the correct, specific error message. It does not change whether errors happen or how they are handled; it only corrects the message sent to the host computer.

This is a small internal code cleanup in the Trezor firmware's Rust UI layer. It moves some MicroPython-specific code into its own submodule and removes an unused import. There is no visible change to user-facing behavior or security-sensitive logic.

This commit only adds a new test case for the Benqi sAVAX redeem function. It includes test data, a small external definition file, and expected screen hashes for automated UI tests. There is no change to production firmware code, no bug fix, and no security patch.

This commit is a minor user-interface fix for Ethereum 'clear signing' flows on Trezor hardware wallets. It simply skips showing a contract-details screen when there are no details to display. There is no indication this is a security fix, and the change does not alter what users must approve before signing a transaction.

This commit removes an unused import of a string type from a Rust source file. It is a routine code cleanup with no functional change and no security relevance.

This commit is a minor user-interface improvement for a developer/debugging tool. It adds a 'verbose' mode to the text output shown when inspecting a Trezor firmware file header. In non-verbose mode it now prints a shorter summary (device model, version, fingerprint, signature/hash status) instead of dumping every header field. There is no change to security checks, cryptography, firmware loading, or device behavior.

This commit adds a `-f/--file` option to Trezor's internal `flash` developer tool so engineers can flash a prebuilt firmware or bootloader file instead of only the binary produced by the current source tree. The same commit also fixes a command-injection risk in the OpenOCD flashing script by properly quoting file paths that contain spaces or special characters. The change is a developer convenience plus a hardening fix; it does not affect end-user device security directly.