What changed, and why it matters
This commit only adds a new automated test for an existing feature called payment_notification, and makes a small helper function in the test code tolerate missing output data. There is no change to the actual Trezor firmware or to any code that runs on the device. It is a test-only change and does not introduce or fix a security issue.
No security action needed; this is a test-only commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds tests/device_tests/misc/test_msg_paymentnotification.py, which exercises the existing misc.payment_notification() API using a payment request with memos but no outputs. To support that, the test helper make_payment_request() in tests/device_tests/payment_req.py is adjusted so outputs=None is handled safely (avoiding iteration over None and allowing amount to be None). No firmware code is modified.
Changed components
tests/device_tests/misc/test_msg_paymentnotification.pytests/device_tests/payment_req.pyInspect captured patch +61 / −3
diff --git a/tests/device_tests/misc/test_msg_paymentnotification.py b/tests/device_tests/misc/test_msg_paymentnotification.py
new file mode 100644
index 000000000..ae6ed5aff
--- /dev/null
+++ b/tests/device_tests/misc/test_msg_paymentnotification.py
@@ -0,0 +1,52 @@
+# This file is part of the Trezor project.
+#
+# Copyright (C) 2012-2025 SatoshiLabs and contributors
+#
+# This library is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License version 3
+# as published by the Free Software Foundation.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Lesser General Public License for more details.
+#
+# You should have received a copy of the License along with this library.
+# If not, see <https://www.gnu.org/licenses/lgpl-3.0.html>.
+
+import pytest
+
+from trezorlib import btc, misc
+from trezorlib.debuglink import SessionDebugWrapper as Session
+from trezorlib.tools import parse_path
+
+
+@pytest.mark.experimental
+@pytest.mark.models("core")
+def test_paymentnotification(session: Session):
+ from ..payment_req import CoinPurchaseMemo, TextMemo, make_payment_request
+
+ purchase_memo = CoinPurchaseMemo(
+ amount="0.0636 BTC",
+ coin_name="Bitcoin",
+ slip44=0,
+ address_n=parse_path("m/44h/0h/0h/0/0"),
+ )
+ purchase_memo.address_resp = btc.get_authenticated_address(
+ session, purchase_memo.coin_name, purchase_memo.address_n
+ )
+
+ text_memo = TextMemo("We will deduct 1234.56 USD from your account")
+
+ nonce = misc.get_nonce(session)
+ payment_request = make_payment_request(
+ session,
+ recipient_name="trezor.io",
+ slip44=0,
+ outputs=None,
+ memos=[purchase_memo, text_memo],
+ nonce=nonce,
+ amount_size_bytes=8,
+ )
+
+ misc.payment_notification(session, payment_request)
diff --git a/tests/device_tests/payment_req.py b/tests/device_tests/payment_req.py
index bc523bd13..08f49043e 100644
--- a/tests/device_tests/payment_req.py
+++ b/tests/device_tests/payment_req.py
@@ -116,7 +116,7 @@ def make_payment_request(
change_address = iter(change_addresses or [])
h_outputs = sha256()
- for amount, address in outputs:
+ for amount, address in outputs or []:
h_outputs.update(amount.to_bytes(amount_size_bytes, "little"))
if not address:
address = next(change_address)
@@ -125,11 +125,17 @@ def make_payment_request(
h_pr.update(h_outputs.digest())
- amount = sum(amount for amount, address in outputs if address)
+ amount = (
+ sum(amount for amount, address in outputs if address)
+ if outputs is not None
+ else None
+ )
return messages.PaymentRequest(
recipient_name=recipient_name,
- amount=amount.to_bytes(amount_size_bytes, "little"),
+ amount=(
+ amount.to_bytes(amount_size_bytes, "little") if amount is not None else None
+ ),
memos=msg_memos,
nonce=nonce,
signature=payment_req_signer.sign_digest_deterministic(h_pr.digest()),
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.