fix(core): preserve THP-BLE name cache across reset/recovery
What the developer wrote
Authored by Martin Milata
fix(core): preserve THP-BLE name cache across reset/recovery
[no changelog]
What changed, and why it matters
This commit fixes a minor consistency bug in Trezor's storage reset logic. When resetting or recovering a device, the code now preserves a cache of paired Bluetooth Low Energy (BLE) device names alongside the BLE bonding data and Trezor-Host Protocol (THP) credentials. Previously, this name cache could be wiped while the underlying bonds/credentials were kept, which could cause confusion or minor pairing issues but does not appear to be a security vulnerability.
Treat as a routine bugfix. No urgent security action required. Reviewers may want to confirm that THP_PAIRED_NAMES is appropriately sized and that restoring it after wipe does not reintroduce stale or attacker-controlled data, though the diff itself does not suggest such a vulnerability.
Security signals we found
No direct security signal: change is a consistency fix for paired-name cache persistence
Potential minor UX/availability concern if name cache inconsistency caused pairing confusion
No evidence of memory safety, cryptographic, or authentication bypass issues in diff
Evidence from the diff
The change modifies core/src/storage/init.py’s reset() function. When USE_THP is enabled, the function already saved device_secret and credential_counter before wiping storage, then restored them afterward. The patch adds paired_names = device.get_thp_paired_names() before the wipe and restores it via common.set(common.APP_DEVICE, device.THP_PAIRED_NAMES, paired_names) afterward. This keeps the THP paired-names cache consistent with preserved BLE bonds/THP credentials across reset/recovery operations.
Changed components
core/src/storage/__init__.pyTrezor Core storage reset/recovery pathTHP (Trezor-Host Protocol) paired names cacheBLE bond/credential persistenceInspect captured patch +4 / −0
diff --git a/core/src/storage/__init__.py b/core/src/storage/__init__.py
index b62eff163..23f52b5b7 100644
--- a/core/src/storage/__init__.py
+++ b/core/src/storage/__init__.py
@@ -46,6 +46,8 @@ def reset(excluded: tuple[AnyBytes, AnyBytes] | None) -> None:
if utils.USE_THP:
device_secret = device.get_device_secret()
credential_counter = device.get_cred_auth_key_counter()
+ # keep the name cache since we're keeping BLE bonds as well as THP credentials
+ paired_names = device.get_thp_paired_names()
wipe(clear_cache=False)
wipe_cache(excluded)
common.set(common.APP_DEVICE, device.DEVICE_ID, device_id.encode(), public=True)
@@ -56,6 +58,8 @@ def reset(excluded: tuple[AnyBytes, AnyBytes] | None) -> None:
device.CRED_AUTH_KEY_COUNTER,
credential_counter,
)
+ if paired_names:
+ common.set(common.APP_DEVICE, device.THP_PAIRED_NAMES, paired_names)
def _migrate_from_version_01() -> None:
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.