What the developer wrote
Authored by Ioan Bizău
fix(delizia): visit summary menus
[no changelog]
What changed, and why it matters
This commit fixes a UI flow issue in the Trezor firmware's Delizia layout. Specifically, it ensures that transaction summary menus are properly included in the device flow, allowing users to access the menu during confirmation. Without this fix, users may not have been able to view or interact with summary details as intended during transaction signing. There is no direct evidence in the commit that this is a security vulnerability, but missing UI steps in a hardware wallet could theoretically affect user verification of transaction details.
Treat as a normal UI/UX fix unless independent security research demonstrates that the missing flow menu could be exploited to bypass user confirmation or hide transaction details. Monitor for related security advisories from Trezor. No immediate security response is indicated by this commit alone.
Security signals we found
UI flow completeness fix in transaction confirmation path
Missing menu interaction on summary/hold-to-confirm screens
No explicit security claim, CVE, or exploit mechanism present in commit
Hardware wallet transaction signing UI affected
Evidence from the diff
The change adds a flow_menu flag to ShowInfoParams and enables it for summary items in confirm_output.rs. It also calls .with_flow_menu() on the confirmation flow frame. This ensures the summary screen and the hold-to-confirm screen participate in the flow menu system. The commit message frames this as a fix for visiting summary menus. No changelog entry is included. There is no explicit security context, exploit primitive, or vulnerability description in the diff or commit metadata.
Changed components
Trezor firmware Delizia UI layoutcore/embed/rust/src/ui/layout_delizia/flow/confirm_output.rscore/embed/rust/src/ui/layout_delizia/flow/util.rsShowInfoParams struct and confirmation flow constructionInspect captured patch +12 / −0
diff --git a/core/embed/rust/src/ui/layout_delizia/flow/confirm_output.rs b/core/embed/rust/src/ui/layout_delizia/flow/confirm_output.rs
index b3bbb563..a16278c4 100644
--- a/core/embed/rust/src/ui/layout_delizia/flow/confirm_output.rs
+++ b/core/embed/rust/src/ui/layout_delizia/flow/confirm_output.rs
@@ -211,6 +211,7 @@ pub fn new_confirm_output(
let res = if let Some(summary_items_params) = summary_items_params {
// Summary
let content_summary = summary_items_params
+ .with_flow_menu(true)
.into_layout()?
.one_button_request(ButtonRequest::from_num(
summary_br_code.unwrap(),
@@ -224,6 +225,7 @@ pub fn new_confirm_output(
SwipeContent::new(PromptScreen::new_hold_to_confirm()),
)
.with_menu_button()
+ .with_flow_menu()
.with_footer(TR::instructions__hold_to_sign.into(), None)
.with_swipe(Direction::Down, SwipeSettings::Default)
.map(super::util::map_to_confirm);
diff --git a/core/embed/rust/src/ui/layout_delizia/flow/util.rs b/core/embed/rust/src/ui/layout_delizia/flow/util.rs
index c2cd09ac..3de3f558 100644
--- a/core/embed/rust/src/ui/layout_delizia/flow/util.rs
+++ b/core/embed/rust/src/ui/layout_delizia/flow/util.rs
@@ -304,6 +304,7 @@ pub struct ShowInfoParams {
swipe_up: bool,
swipe_down: bool,
items: Vec<(TString<'static>, TString<'static>), 4>,
+ flow_menu: bool,
}
impl ShowInfoParams {
@@ -318,6 +319,7 @@ impl ShowInfoParams {
swipe_up: false,
swipe_down: false,
items: Vec::new(),
+ flow_menu: false,
}
}
@@ -380,6 +382,11 @@ impl ShowInfoParams {
self
}
+ pub const fn with_flow_menu(mut self, flow_menu: bool) -> Self {
+ self.flow_menu = flow_menu;
+ self
+ }
+
#[inline(never)]
pub fn into_layout(
self,
@@ -416,6 +423,9 @@ impl ShowInfoParams {
if let Some(instruction) = self.footer_instruction {
frame = frame.with_footer(instruction, self.footer_description);
}
+ if self.flow_menu {
+ frame = frame.with_flow_menu();
+ }
if self.swipe_up {
frame = frame.with_swipe(Direction::Up, SwipeSettings::Default);
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.