fix(storage): unify number of pin attemps to 10 on devices using Tropic
What the developer wrote
Authored by cepetr
fix(storage): unify number of pin attemps to 10 on devices using Tropic
[no changelog]
What changed, and why it matters
This commit changes how many wrong PIN attempts are allowed on Trezor hardware wallets that use a component called Tropic. Previously, devices using both Tropic and Optiga security chips were limited to 10 PIN attempts, while devices using only Tropic were allowed 16. The change makes all Tropic-based devices use 10 attempts, matching the stricter limit. This is a defensive consistency fix, not an active vulnerability patch, but it reduces the attack surface for PIN brute-force attempts on Tropic-only devices.
No urgent action required. This is a defensive hardening change. Users with Tropic-only devices will see their maximum allowed wrong PIN attempts reduced from 16 to 10, which improves security. Ensure firmware release notes communicate this behavior change to avoid user confusion.
Security signals we found
PIN attempt limit reduction
Tropic secure element configuration
Brute-force mitigation
Defensive hardening
Evidence from the diff
The patch modifies storage/storage.h to broaden the preprocessor condition for PIN_MAX_TRIES = 10 from USE_TROPIC && USE_OPTIGA to just USE_TROPIC. The comment explains that when both chips are present, each PIN attempt consumes a stretched PIN slot in Optiga, restricting attempts to 10. For simplicity and consistency, Tropic-only devices are now also limited to 10 attempts even though they could theoretically support 16. The change reduces the maximum PIN guess window for Tropic-only configurations.
Changed components
storage/storage.hPIN counter logicTropic-only Trezor devicesInspect captured patch +4 / −3
diff --git a/storage/storage.h b/storage/storage.h
index 6890bf81..524a6c05 100644
--- a/storage/storage.h
+++ b/storage/storage.h
@@ -44,10 +44,11 @@ extern const uint8_t *PIN_EMPTY;
// Maximum number of failed unlock attempts.
// NOTE: The PIN counter logic relies on this constant being less than or equal
// to 16.
-#if USE_TROPIC && USE_OPTIGA
+#if USE_TROPIC
// If both Optiga and Tropic are used, every PIN attempt requires a stretched
-// PIN slot on Optiga. This restricts the total number of PIN
-// attempts.
+// PIN slot in Optiga. This restricts the total number of PIN attempts to 10.
+// For simplicity we set the number of attempts to 10 when Tropic is used
+// without Optiga, even though more attempts could be supported.
#define PIN_MAX_TRIES 10
#else
#define PIN_MAX_TRIES 16
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.