fix(core): allow Evolu msgs in BTC only

Trezor/Trezor firmware

06c82aff View source ↗

Public commit record

What the developer wrote

Authored by obrusvit

57/100 · Thin

fix(core): allow Evolu msgs in BTC only

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit changes which Trezor firmware variant supports the 'Evolu' messages. Previously, these messages were only available in the full (non-Bitcoin-only) firmware. The patch marks them as available in the Bitcoin-only firmware instead. It is a feature-availability fix rather than a direct security patch, but misclassification of message availability could theoretically affect the attack surface of the Bitcoin-only build.

Recommended action

Verify that Evolu functionality is intentionally supported in Bitcoin-only firmware and that exposing these messages does not introduce unintended capabilities or expand the Bitcoin-only attack surface. Review the Evolu message handlers for robust input validation.

Security signals we found

Message-type availability boundary changed between firmware variants

Bitcoin-only flag added to previously non-Bitcoin-only messages

Generated protobuf bindings regenerated to reflect variant gating

Technical analysis

Evidence from the diff

The commit adds the (bitcoin_only) = true option to MessageType_EvoluGetNode and MessageType_EvoluNode in messages.proto, imports options.proto and sets option (include_in_bitcoin_only) = true in messages-evolu.proto, and regenerates the Python and Rust protobuf bindings so that EvoluGetNode/EvoluNode are defined unconditionally in MessageType.py rather than under the if not utils.BITCOIN_ONLY branch. This moves the Evolu message support from the universal/alts firmware to the Bitcoin-only firmware.

Changed components

common/protob/messages-evolu.protocommon/protob/messages.protocore/src/trezor/enums/MessageType.pyrust/trezor-client/src/protos/generated/messages.rsrust/trezor-client/src/protos/generated/messages_evolu.rs

Inspect captured patch +28 / −21

diff --git a/common/protob/messages-evolu.proto b/common/protob/messages-evolu.proto
index 457b7a0a0..ef4b5dd77 100644
--- a/common/protob/messages-evolu.proto
+++ b/common/protob/messages-evolu.proto
@@ -2,6 +2,10 @@
 syntax = "proto2";
 package hw.trezor.messages.evolu;
 
+import "options.proto";
+
+option (include_in_bitcoin_only) = true;
+
 // Sugar for easier handling in Java
 option java_package = "com.satoshilabs.trezor.lib.protobuf";
 option java_outer_classname = "TrezorMessageEvolu";
diff --git a/common/protob/messages.proto b/common/protob/messages.proto
index c27235e28..cbe875ef9 100644
--- a/common/protob/messages.proto
+++ b/common/protob/messages.proto
@@ -338,8 +338,8 @@ enum MessageType {
     MessageType_NostrEventSignature = 2004 [(wire_out) = true];
 
     // Evolu
-    MessageType_EvoluGetNode = 2100 [(wire_in) = true];
-    MessageType_EvoluNode = 2101 [(wire_out) = true];
+    MessageType_EvoluGetNode = 2100 [(bitcoin_only) = true, (wire_in) = true];
+    MessageType_EvoluNode = 2101 [(bitcoin_only) = true, (wire_out) = true];
 
     // Benchmark
     MessageType_BenchmarkListNames = 9100 [(bitcoin_only) = true];
diff --git a/core/src/trezor/enums/MessageType.py b/core/src/trezor/enums/MessageType.py
index 7d011aff0..4b688d77a 100644
--- a/core/src/trezor/enums/MessageType.py
+++ b/core/src/trezor/enums/MessageType.py
@@ -84,6 +84,8 @@ SignedIdentity = 54
 GetECDHSessionKey = 61
 ECDHSessionKey = 62
 PaymentNotification = 52
+EvoluGetNode = 2100
+EvoluNode = 2101
 BenchmarkListNames = 9100
 BenchmarkNames = 9101
 BenchmarkRun = 9102
@@ -259,5 +261,3 @@ if not utils.BITCOIN_ONLY:
     NostrPubkey = 2002
     NostrSignEvent = 2003
     NostrEventSignature = 2004
-    EvoluGetNode = 2100
-    EvoluNode = 2101
diff --git a/rust/trezor-client/src/protos/generated/messages.rs b/rust/trezor-client/src/protos/generated/messages.rs
index 48eed6028..22503df64 100644
--- a/rust/trezor-client/src/protos/generated/messages.rs
+++ b/rust/trezor-client/src/protos/generated/messages.rs
@@ -1614,7 +1614,7 @@ impl MessageType {
 }
 
 static file_descriptor_proto_data: &'static [u8] = b"\
-    \n\x0emessages.proto\x12\x12hw.trezor.messages\x1a\roptions.proto*\x9bY\
+    \n\x0emessages.proto\x12\x12hw.trezor.messages\x1a\roptions.proto*\xa3Y\
     \n\x0bMessageType\x12(\n\x16MessageType_Initialize\x10\0\x1a\x0c\x80\xa6\
     \x1d\x01\xb0\xb5\x18\x01\x90\xb5\x18\x01\x12\x1e\n\x10MessageType_Ping\
     \x10\x01\x1a\x08\x80\xa6\x1d\x01\x90\xb5\x18\x01\x12%\n\x13MessageType_S\
@@ -1899,18 +1899,19 @@ static file_descriptor_proto_data: &'static [u8] = b"\
     sageType_NostrGetPubkey\x10\xd1\x0f\x1a\x04\x90\xb5\x18\x01\x12\"\n\x17M\
     essageType_NostrPubkey\x10\xd2\x0f\x1a\x04\x98\xb5\x18\x01\x12%\n\x1aMes\
     sageType_NostrSignEvent\x10\xd3\x0f\x1a\x04\x90\xb5\x18\x01\x12*\n\x1fMe\
-    ssageType_NostrEventSignature\x10\xd4\x0f\x1a\x04\x98\xb5\x18\x01\x12#\n\
-    \x18MessageType_EvoluGetNode\x10\xb4\x10\x1a\x04\x90\xb5\x18\x01\x12\x20\
-    \n\x15MessageType_EvoluNode\x10\xb5\x10\x1a\x04\x98\xb5\x18\x01\x12)\n\
-    \x1eMessageType_BenchmarkListNames\x10\x8cG\x1a\x04\x80\xa6\x1d\x01\x12%\
-    \n\x1aMessageType_BenchmarkNames\x10\x8dG\x1a\x04\x80\xa6\x1d\x01\x12#\n\
-    \x18MessageType_BenchmarkRun\x10\x8eG\x1a\x04\x80\xa6\x1d\x01\x12&\n\x1b\
-    MessageType_BenchmarkResult\x10\x8fG\x1a\x04\x80\xa6\x1d\x01\x1a\x08\xc8\
-    \xf3\x18\x01\xd0\xf3\x18\x01\"\x04\x08Z\x10\\\"\x04\x08G\x10J\"\x04\x08r\
-    \x10z\"\x06\x08\xdb\x01\x10\xdb\x01\"\x06\x08\xe0\x01\x10\xe0\x01\"\x06\
-    \x08\xac\x02\x10\xb0\x02\"\x06\x08\xb5\x02\x10\xb8\x02\"\x06\x08\xbc\x05\
-    \x10\xc5\x05\"\x06\x08\xe9\x07\x10\xf7\x07\"\x06\x08\xfa\x07\x10\xcb\x08\
-    B8\n#com.satoshilabs.trezor.lib.protobufB\rTrezorMessage\x80\xa6\x1d\x01\
+    ssageType_NostrEventSignature\x10\xd4\x0f\x1a\x04\x98\xb5\x18\x01\x12'\n\
+    \x18MessageType_EvoluGetNode\x10\xb4\x10\x1a\x08\x80\xa6\x1d\x01\x90\xb5\
+    \x18\x01\x12$\n\x15MessageType_EvoluNode\x10\xb5\x10\x1a\x08\x80\xa6\x1d\
+    \x01\x98\xb5\x18\x01\x12)\n\x1eMessageType_BenchmarkListNames\x10\x8cG\
+    \x1a\x04\x80\xa6\x1d\x01\x12%\n\x1aMessageType_BenchmarkNames\x10\x8dG\
+    \x1a\x04\x80\xa6\x1d\x01\x12#\n\x18MessageType_BenchmarkRun\x10\x8eG\x1a\
+    \x04\x80\xa6\x1d\x01\x12&\n\x1bMessageType_BenchmarkResult\x10\x8fG\x1a\
+    \x04\x80\xa6\x1d\x01\x1a\x08\xc8\xf3\x18\x01\xd0\xf3\x18\x01\"\x04\x08Z\
+    \x10\\\"\x04\x08G\x10J\"\x04\x08r\x10z\"\x06\x08\xdb\x01\x10\xdb\x01\"\
+    \x06\x08\xe0\x01\x10\xe0\x01\"\x06\x08\xac\x02\x10\xb0\x02\"\x06\x08\xb5\
+    \x02\x10\xb8\x02\"\x06\x08\xbc\x05\x10\xc5\x05\"\x06\x08\xe9\x07\x10\xf7\
+    \x07\"\x06\x08\xfa\x07\x10\xcb\x08B8\n#com.satoshilabs.trezor.lib.protob\
+    ufB\rTrezorMessage\x80\xa6\x1d\x01\
 ";
 
 /// `FileDescriptorProto` object which was a source for this generated file
diff --git a/rust/trezor-client/src/protos/generated/messages_evolu.rs b/rust/trezor-client/src/protos/generated/messages_evolu.rs
index ffeefbb30..e67faab3b 100644
--- a/rust/trezor-client/src/protos/generated/messages_evolu.rs
+++ b/rust/trezor-client/src/protos/generated/messages_evolu.rs
@@ -289,9 +289,10 @@ impl ::protobuf::reflect::ProtobufValue for EvoluNode {
 }
 
 static file_descriptor_proto_data: &'static [u8] = b"\
-    \n\x14messages-evolu.proto\x12\x18hw.trezor.messages.evolu\"\x0e\n\x0cEv\
-    oluGetNode\"\x1f\n\tEvoluNode\x12\x12\n\x04data\x18\x01\x20\x02(\x0cR\
-    \x04dataB9\n#com.satoshilabs.trezor.lib.protobufB\x12TrezorMessageEvolu\
+    \n\x14messages-evolu.proto\x12\x18hw.trezor.messages.evolu\x1a\roptions.\
+    proto\"\x0e\n\x0cEvoluGetNode\"\x1f\n\tEvoluNode\x12\x12\n\x04data\x18\
+    \x01\x20\x02(\x0cR\x04dataB=\n#com.satoshilabs.trezor.lib.protobufB\x12T\
+    rezorMessageEvolu\x80\xa6\x1d\x01\
 ";
 
 /// `FileDescriptorProto` object which was a source for this generated file
@@ -308,7 +309,8 @@ pub fn file_descriptor() -> &'static ::protobuf::reflect::FileDescriptor {
     static file_descriptor: ::protobuf::rt::Lazy<::protobuf::reflect::FileDescriptor> = ::protobuf::rt::Lazy::new();
     file_descriptor.get(|| {
         let generated_file_descriptor = generated_file_descriptor_lazy.get(|| {
-            let mut deps = ::std::vec::Vec::with_capacity(0);
+            let mut deps = ::std::vec::Vec::with_capacity(1);
+            deps.push(super::options::file_descriptor().clone());
             let mut messages = ::std::vec::Vec::with_capacity(2);
             messages.push(EvoluGetNode::generated_message_descriptor_data());
             messages.push(EvoluNode::generated_message_descriptor_data());

Risk score

Why this scored 29/100

Our methodology →

Potential impact 5/30

Exploitability 5/25

Stealth signal 5/15

Affected reach 5/15

Confidence 6/10

Evidence quality 3/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 29/100

Community notes

Related watches

test(core/ethereum): EIP-7702 tuple nonce must be non-zero

build(core): propagate emulator feature from projects

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding