AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 21 Bitcoin

Revert "chore: remove `GetNonce` and `PaymentRequest` from experimental features"

Public commit record

What the developer wrote

Authored by Roman Zeyde

65/100 · Adequate
Revert "chore: remove `GetNonce` and `PaymentRequest` from experimental features"

This reverts commit 6b844d37489d79e88d1cec6a443fe550a5f6469d.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit is a simple revert that puts two features—PaymentRequest and GetNonce/Nonce—back into the 'experimental' category in Trezor's protocol definitions. It does not fix or introduce a security bug; it just re-labels fields and messages as experimental again and updates generated code and tests accordingly. The change is administrative: it re-enables the experimental flag so these features are only usable when a device has experimental features turned on.

Recommended action

No security action required. Reviewers should confirm that the firmware runtime still enforces the experimental-features flag for these messages/fields, since the protobuf annotations alone are only metadata.

Security signals we found

01

Re-adds experimental gating to PaymentRequest and GetNonce/Nonce protobuf messages/fields

02

No code logic changes to signing, nonce generation, or payment-request validation

03

Generated Rust descriptors updated to depend on options.proto and encode experimental annotations

04

Tests re-tagged as experimental and UI fixture hashes updated

Risk score

Why this scored 21/100

Our methodology →
Potential impact 2/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.