AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

feat(core): show an explicit warning when `ButtonRequest` ACK is delayed

Public commit record

What the developer wrote

Authored by Roman Zeyde

100/100 · Strong
feat(core): show an explicit warning when `ButtonRequest` ACK is delayed

This should help the user to avoid the "blank screen" issue[1]
(if the layout is closed before `ButtonRequest` loop is done, the
user will see a blank screen - until a new message is received).

This PR doesn't allow the user to abort the layout task, since
it may leave the THP channel in a "non-writeable" state (if the
flow is aborted before `ButtonRequest` THP-level ACK is received,
ABP will prevent further writes into the channel[2].

[1]: https://github.com/trezor/trezor-firmware/issues/5884
[2]: https://github.com/trezor/trezor-firmware/blob/4aa242ba0404cf92c41a01ab78247054dcb50df7/core/src/trezor/wire/thp/channel.py#L415
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit adds a user-facing warning message on Trezor devices when the connected computer or phone is slow to respond during a button-confirmation step. It is a usability improvement to prevent users from seeing a confusing blank screen; it does not fix a vulnerability and does not introduce a new attack path.

Recommended action

No security action required; treat as a normal feature/usability improvement. Reviewers may verify the 2-second timeout and the non-abort behavior match the THP synchronization requirements described in the commit message.

Security signals we found

01

UI/UX hardening against blank-screen confusion during delayed ButtonRequest ACK

02

THP channel synchronization preserved by continuing to await ACK and not allowing abort

03

New translated warning string added to communicate communication delay to user

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.