CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

test(core): allow wiping via DebugLink

TZ601ef837 View source ↗
Public commit record

What the developer wrote

Authored by Roman Zeyde

82/100 · Strong
test(core): allow wiping via DebugLink

It allows THP-based debug builds to be wiped without unlocking.

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit adds a debug-only testing feature that lets automated tests wipe a Trezor device through the DebugLink interface without first unlocking it. It is intended to make testing easier for newer Trezor devices that use the THP protocol. The change only affects debug builds and is not present in production firmware, so it does not directly endanger real users. However, it does add a path where a debug build can erase the device without authentication, which is a security-relevant design choice for test/debug environments.

Recommended action

Verify that the new WipeDevice handler is compiled only in __debug__ builds and cannot be reached in production firmware. Review whether DebugLink is disabled or gated in release builds so that this wipe path is not accessible to an attacker with physical USB access. Confirm that the RestartEventLoop exception cannot leak into non-debug code paths or be triggered by other messages.

Security signals we found

01

Debug-only code path added that can wipe device storage without authentication

02

WipeDevice message type registered in debug message handler table

03

RestartEventLoop exception used to reset event loop after wipe

04

Test infrastructure changed to rely on DebugLink wipe instead of normal WipeDevice workflow

05

Commit message explicitly states intent: allow wiping without unlocking in THP debug builds

Risk score

Why this scored 27/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Trezor firmware

Related watches

Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore: remove libtropic's pin to develop branch

This commit removes a single line from the project's Git submodule configuration. It stops pinning the libtropic submodule to the 'develop' branch, meaning the project will now use the submodule's default branch (likely 'main' or 'master')…

8290eeefby M1nd3r+0−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 70 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core/embed): clear temporary buffer across Optiga/Tropic calls

This is a hardening change for the random number generator inside Trezor hardware wallets. It makes sure that temporary memory holding secret random values from the Optiga and Tropic security chips is wiped immediately after use, rather th…

Sensitive intermediate buffer not cleared promptlyPotential stale-buffer reuse across RNG source boundariesDefense-in-depth memory sanitization for secure-element entropy
01ebda93by Roman Zeyde+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(core/ethereum): EIP-7702 tuple nonce must be non-zero

This commit only changes test data and expected screen fingerprints for Trezor's Ethereum EIP-7702 signing tests. It replaces one test case that used a nonce of 0 with the same scenario using a nonce of 67, because the real-world protocol …

Test-only change with no production code modificationEIP-7702 tuple nonce constraint reflected in test dataExpected UI test hashes regenerated for renamed test vector
76cd2ed4by Roman Zeyde+28−282 files
No security note in commit
Open full analysis →Source commit ↗