fix(bolt): webauthn credential scrolling
What the developer wrote
Authored by Ioan Bizău
fix(bolt): webauthn credential scrolling
What changed, and why it matters
This commit fixes a UI bug in the Trezor hardware wallet where scrolling through FIDO/WebAuthn credentials could behave incorrectly. The change updates the displayed account name in place rather than recreating the whole text element each time the page changes. There is no direct evidence this is a security vulnerability; it appears to be a user-experience fix for on-screen credential navigation.
Treat as a routine bug-fix/UX patch. No security response required unless additional information shows the scrolling bug could hide or misrepresent credentials during security-critical user confirmation flows.
Security signals we found
No memory-unsafe operations introduced or removed
No input parsing, authentication, or cryptographic code touched
Change is purely UI rendering/state update in a hardware-wallet display component
No vendor statement of security relevance in commit or changelog
Evidence from the diff
In the Bolt layout’s FIDO component (core/embed/rust/src/ui/layout_bolt/component/fido.rs), the on_event handler previously called Paragraph::new(...).into_paragraphs() to rebuild self.account_name on every page change. The patch replaces that reconstruction with an in-place update() call on the existing paragraphs. This is a minimal, localized fix for credential scrolling behavior on the T2T1 (Trezor Model T) device. The diff does not show bounds checking, memory safety, or cryptographic changes.
Changed components
Trezor firmware core UI (Bolt layout)FIDO/WebAuthn credential list screen on T2T1 (Trezor Model T)Inspect captured patch +3 / −2
diff --git a/core/.changelog.d/6236.fixed b/core/.changelog.d/6236.fixed
new file mode 100644
index 00000000..18fb7f54
--- /dev/null
+++ b/core/.changelog.d/6236.fixed
@@ -0,0 +1 @@
+[T2T1] Fixed FIDO credentials scrolling.
diff --git a/core/embed/rust/src/ui/layout_bolt/component/fido.rs b/core/embed/rust/src/ui/layout_bolt/component/fido.rs
index 99da6057..ef3974c0 100644
--- a/core/embed/rust/src/ui/layout_bolt/component/fido.rs
+++ b/core/embed/rust/src/ui/layout_bolt/component/fido.rs
@@ -101,8 +101,8 @@ where
self.page_swipe.allow_right = self.scrollbar.has_previous_page();
self.page_swipe.allow_left = self.scrollbar.has_next_page();
- let current_account = (self.get_account)(self.active_page());
- self.account_name = Paragraph::new(&theme::TEXT_MONO, current_account).into_paragraphs();
+ self.account_name
+ .update((self.get_account)(self.active_page()));
// Redraw the page.
ctx.request_paint();
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.