fix(core): erase BLE bonds when wiping the device
What the developer wrote
Authored by Roman Zeyde
fix(core): erase BLE bonds when wiping the device
[no changelog]
What changed, and why it matters
This commit fixes a security gap in the Trezor hardware wallet's device-wipe feature. Previously, when a user chose to wipe their device, the secure secrets were erased but Bluetooth Low Energy (BLE) pairing records ('bonds') stored on the Bluetooth chip were left behind. Those leftover bonds could let a previously paired phone or computer reconnect to the wiped device, which is a privacy and minor security concern. The change now erases those BLE bonds during the wipe process.
Treat as a low-to-moderate security hardening fix. Ensure the erase_bonds() call is present in all BLE-enabled firmware builds and that it is exercised in wipe-device QA. Consider whether any other persistent peripheral state (NFC, USB descriptors, etc.) should also be cleared on wipe.
Security signals we found
Incomplete data sanitization during device wipe/factory reset
Bluetooth bond data retained after security-sensitive reset
Privacy risk from persistent pairing metadata
Fix is conditional on USE_BLE compile-time flag
Evidence from the diff
The patch modifies core/src/apps/management/wipe_device.py to import utils and, when the build has BLE support (utils.USE_BLE), call trezorble.erase_bonds() after reload_settings_from_storage(). The comment says it will raise an exception if bond erasure fails. This closes a cleanup gap where a factory reset/wipe left bonded Bluetooth peer keys on the BLE controller.
Changed components
core/src/apps/management/wipe_device.pyTrezor Safe firmware BLE-enabled buildstrezorble.erase_bondsInspect captured patch +8 / −0
diff --git a/core/src/apps/management/wipe_device.py b/core/src/apps/management/wipe_device.py
index b4f2b628f..bcde9c8f1 100644
--- a/core/src/apps/management/wipe_device.py
+++ b/core/src/apps/management/wipe_device.py
@@ -1,5 +1,6 @@
from typing import TYPE_CHECKING
+from trezor import utils
from trezor.wire.context import get_context, try_get_ctx_ids
if TYPE_CHECKING:
@@ -58,5 +59,12 @@ async def wipe_device(msg: WipeDevice) -> NoReturn:
# reload settings
reload_settings_from_storage()
+
+ if utils.USE_BLE:
+ from trezorble import erase_bonds
+
+ # raise an exception if bonds erasing fails
+ erase_bonds()
+
if __debug__:
log.debug(__name__, "Device wipe - finished")
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.