Trezor firmware

This commit changes how Trezor hardware wallets handle a new Ethereum feature called EIP-7702, which lets users temporarily delegate control of their account to another smart contract. Previously, Trezor only allowed this delegation if the user lowered their safety settings. Now, it allows delegation under the strictest safety settings, but only for a pre-approved list of delegate addresses. Revocation (removing a delegate) was already allowed under strict settings and remains allowed. The change is framed as adding 'strict safety checks' rather than removing protections entirely.

This update fixes a logic flaw in Trezor's Ethereum signing code. When a user was doing an ERC-20 token swap using a SLIP-24 payment request, the device could also be instructed to send native ETH at the same time. That combination is not expected in a normal token swap and could let an attacker trick the user into authorizing an unintended ETH transfer alongside the token swap. The fix now rejects such transactions outright.

This commit only adds a new automated test case for signing an Ethereum ERC-20 token transfer using a SLIP-24 payment request. It does not change any production firmware code, so it cannot introduce a security vulnerability or directly fix one in shipped software. The change is purely in the test suite and its recorded expected screen outputs.

This commit only refactors a single automated test file for Ethereum transaction signing on Trezor hardware wallets. It extracts duplicated code into a helper function and updates how the test checks for an expected error message. There is no change to the actual firmware, wallet logic, or security behavior.

This commit is a routine German translation update. It changes the wording on a wallet recovery button and refreshes the translation signature file that verifies the translations are authentic. There is no security issue here.

This commit adds a hard limit on how deeply nested Protobuf messages can be when the Trezor device decodes them. Without such a limit, a malicious or malformed message could nest messages inside messages indefinitely, potentially crashing the device or causing other problems. The change caps nesting at 16 levels and adds a test to confirm that deeper nesting is rejected.

This is a routine performance refactor in Trezor's Python library. It replaces a slow, CPU-heavy way of measuring nested protobuf message sizes with a faster approach that builds the message in memory once. There is no indication this fixes a security vulnerability; it is described purely as a speed improvement.

This commit is a routine code cleanup to satisfy the Rust Clippy linter. It removes unnecessary reference symbols (&), rewrites a small match block to assign a value directly, and removes an unused import. There is no functional change and no security relevance visible in the diff.

This change fixes a logic bug in how Trezor handles Solana staking transactions. Previously, the device could ask the user to confirm a staking detail before it had fully verified that the transaction matched a safe, predefined pattern. The fix moves that confirmation check to after all safety checks are complete, so the device only asks for confirmation when it is confident the transaction is a known, legitimate staking flow. This prevents a potentially malicious or malformed transaction from tricking the user into confirming something risky.

This commit changes how Trezor hardware wallets handle Tron smart-contract calls that include native TRX tokens. Previously, the device did not display or validate the `call_value` field, which means a user could be tricked into sending TRX along with a contract call without seeing it on the device screen. The patch adds a safety check that rejects oversized values and shows the TRX amount during transaction confirmation. It is a defensive fix rather than an exploit.

This commit fixes a bug in the Trezor hardware wallet's Ethereum transaction signing flow. When using SLIP-24 payment requests with ERC-20 token transfers, the device could incorrectly skip the user-confirmation step for the transaction details. The fix ensures that 'clear signing' mode (which bypasses some confirmations) is checked before the payment-request path, so users still see and approve the token transfer details.

This commit only updates translated text strings in Czech, German, Spanish, French, and Portuguese translation files, plus the corresponding translation signature metadata. There are no code changes, no security fixes, and no behavior changes. It is a routine localization sync.

This commit improves the on-screen confirmation experience when creating an advanced Shamir backup on a Trezor device. It adds extra prompts that show the user how many backup groups exist, how many groups are needed to recover the wallet, and the threshold for each individual group. There is no security vulnerability here; it is purely a user-interface improvement to help people verify their backup settings.

This commit is a routine translation update for the Trezor hardware wallet firmware. It only changes user-facing text strings in Czech, German, Spanish, French, and Portuguese translation files, plus the translation signature metadata. There are no code logic changes, no security fixes, and no functional changes to how the device operates.

This commit removes an unused translation string called 'stellar__timebounds' from the Trezor firmware's translation system. It is a cleanup/refactoring change with no visible effect on device behavior or security. The signatures.json file was also updated because removing a string changes the cryptographic hash (merkle root) used to verify translation files.

This commit only regenerates translation files after some text labels were moved from one category to another (for example, 'Authenticate' and 'Wipe' were changed from general words to button labels). There is no code behavior change, no bug fix, and no security relevance visible in the diff.

This commit fixes a bug in Trezor's Ripple (XRP) signing code. When a payment request included a destination tag of 0, the device treated it as if no tag was set, so it did not show or verify the tag. Because destination tags are used to route funds to the correct recipient on exchanges, omitting tag 0 could let an attacker trick a user into approving a payment that looks tagless but actually sends to tag 0, potentially sending funds to the wrong account or making them hard to recover.

This update fixes a bug in how Trezor handles certain Monero 'sweep' transactions. In a sweep, one output is a fake zero-value decoy with a random address, and the device normally skips checking that the change address belongs to the wallet. A malicious computer app could exploit that skip by claiming the real payment recipient's address is the change address. The device would then encrypt the recipient's output using the wallet's own secret view key, making the money effectively unspendable by the recipient and unrecoverable by the sender. The fix adds a check: if the unvalidated change address appears on any output that actually carries money, the transaction is rejected. Honest sweeps, where the decoy carries zero coins, still work normally.

This commit only refreshes test data files: it updates a translation signature metadata file and regenerates UI test fixtures. There is no code change, no security fix, and no indication of a vulnerability being addressed.

This is a harmless internal cleanup: the word "Network" was previously stored separately for Cardano and Ethereum, and is now merged into a single shared translation key called words__network. No user-facing text, security behavior, or transaction logic changed.

This commit only updates translated text strings in Czech, German, and Spanish language files, plus the corresponding translation signature metadata. There are no code, logic, or security-related changes.

This commit only adds a new test case for the Stellar cryptocurrency feature. It records an expected transaction signature for a 'remove signer' operation so the device can be tested against a known-good value. There is no code change, no bug fix, and no security-relevant behavior change.

This update fixes how the Trezor hardware wallet displays a Stellar 'Set options' operation when a signer is being added or changed. Previously, the device did not show the signer's 'weight' value on its screen. Because weight controls how powerful a signer is (for example, how many signatures are needed to approve a transaction), a user could unknowingly approve a high-weight signer that gives an attacker more control over the account. The fix now shows the weight during confirmation, so users can spot suspicious changes before signing.

This commit fixes a bug in how the Trezor hardware wallet builds Nostr event signatures. Previously, special characters in the event content and tags (like quotes, backslashes, tabs, and newlines) were not properly escaped when creating the JSON string that gets signed. This could cause the device to compute a signature that does not match what standard Nostr software expects, or in some cases could allow a malicious app to craft content that changes the meaning of what the user approved on screen versus what is actually signed. The fix adds proper JSON string escaping for both the main content and tag strings.

This update fixes a display bug in Trezor's Solana token-transfer confirmation screen. When a token transfer uses Solana Address Lookup Tables (ALTs) to refer to the token mint or the owner account, the device previously showed the lookup-table address as if it were the real account address. That could trick a user into approving a transfer they did not fully understand. The fix makes these cases fall back to a more cautious, generic confirmation screen that clearly marks ALT references.