What the developer wrote
Authored by matejcik
fix(python): fix broken HID transport
What changed, and why it matters
This commit fixes a missing constant in Trezor's Python library that talks to hardware wallets over USB HID. The change adds CHUNK_SIZE = 64, which likely restores normal communication with devices. There is no direct evidence in the commit that this is a security vulnerability, and no exploit path is visible from the diff alone.
Treat as a functional bug fix unless further analysis shows the missing CHUNK_SIZE caused message truncation, replay, or protocol confusion. Users of the Python library should update to the fixed version to restore HID connectivity. Security reviewers may want to verify whether the absent constant could lead to protocol-level issues such as partial messages being parsed.
Security signals we found
Missing size constant restored in transport layer
Communication failure with hardware wallet possible without the constant
No explicit security claim in commit message or changelog
Evidence from the diff
The patch adds a class-level constant CHUNK_SIZE = 64 to HidTransport in python/src/trezorlib/transport/hid.py. Without this constant, the HID transport likely failed to send/receive messages of the expected size, breaking device communication. The diff does not show any buffer-size calculation, memory handling, or authentication logic, so security implications are speculative. The changelog fragment only says ‘Fix broken HID transport.’
Changed components
python/src/trezorlib/transport/hid.pyTrezor Python client library HID transportInspect captured patch +2 / −0
diff --git a/python/.changelog.d/tbd_hid_transport_chunk_size_fix.fixed b/python/.changelog.d/tbd_hid_transport_chunk_size_fix.fixed
new file mode 100644
index 00000000..d42ea672
--- /dev/null
+++ b/python/.changelog.d/tbd_hid_transport_chunk_size_fix.fixed
@@ -0,0 +1 @@
+Fix broken HID transport.
diff --git a/python/src/trezorlib/transport/hid.py b/python/src/trezorlib/transport/hid.py
index 82f750b8..45468297 100644
--- a/python/src/trezorlib/transport/hid.py
+++ b/python/src/trezorlib/transport/hid.py
@@ -47,6 +47,7 @@ class HidTransport(Transport):
PATH_PREFIX = "hid"
ENABLED = HID_IMPORTED
+ CHUNK_SIZE = 64
def __init__(self, device: HidDevice, probe_hid_version: bool = False) -> None:
self.device = device
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.