refactor(core): show backup success after I/O-related errors
What the developer wrote
Authored by Roman Zeyde
refactor(core): show backup success after I/O-related errors
In case the host is unavailable, #6651 will stop sending ButtonRequests.
This PR makes sure that `show_backup_success()` won't fail if there was
an error during the backup process - so the success screen will be
shown to the user.
Currently THP debug builds fail with an assertion if the FW tries to
write again before the previous write was ACKed, so this PR makes sure
that after an error no ButtonRequest will be sent after #6651 is merged.
Note: writing the secret to storage is not affected by this change
(since it doesn't access the active context / button request handler).
[no changelog]
What changed, and why it matters
This change widens the code's error-swallowing behavior during wallet setup so that I/O problems (like a disconnected computer) don't crash the backup flow and still show a success screen. It is described as a robustness/refactor fix, not a security fix. There is no direct evidence it introduces a vulnerability, but it does mean certain failures during backup could be silently ignored and the user might see 'success' even though something went wrong.
Treat as a code-quality/robustness change rather than a security patch. Review whether silently swallowing errors around `store_mnemonic_secret` and `show_backup_success` could mask real backup or storage failures; consider ensuring the user is clearly informed if backup was not fully completed before showing a success screen. No immediate security response is indicated by the commit itself.
Security signals we found
Error suppression scope expanded to include storage writes and success UI
Success screen may be shown despite prior I/O or backup errors
Described as refactor/robustness, not a security vulnerability fix
No changelog entry provided
Depends on behavior of unmerged PR #6651
Evidence from the diff
The commit moves a with continue_on_errors("Backup in progress"): context manager so it now wraps not just backup_seed() but also storage writes (storage_device.set_label, set_passphrase_enabled, store_mnemonic_secret) and layout.show_backup_success(). The stated goal is to prevent show_backup_success() from sending a ButtonRequest after a prior I/O error once PR #6651 stops sending ButtonRequests when the host is unavailable. The secret-to-storage write is noted as unaffected because it doesn’t use the active context/button request handler. The change is framed as a refactor/THP-debug-build fix, with no changelog entry.
Changed components
core/src/apps/management/reset_device/__init__.pyTrezor Model T / Core firmware reset_device flowbackup_seed() and backup success UIstorage_device mnemonic/label/passphrase persistenceInspect captured patch +16 / −15
diff --git a/core/src/apps/management/reset_device/__init__.py b/core/src/apps/management/reset_device/__init__.py
index d9dcd8d8..66cbea5c 100644
--- a/core/src/apps/management/reset_device/__init__.py
+++ b/core/src/apps/management/reset_device/__init__.py
@@ -124,9 +124,10 @@ async def reset_device(msg: ResetDevice) -> Success:
if perform_backup:
perform_backup = await prompt_backup()
- # generate and display backup information for the master secret
- if perform_backup:
- with continue_on_errors("Backup in progress"):
+ # avoid failing backup process due to I/O-related errors
+ with continue_on_errors("Backup in progress"):
+ # generate and display backup information for the master secret
+ if perform_backup:
# choose backup handler (prompt the user if method is `None`)
handler = await layout.choose_backup_handler(msg.backup_method)
await backup_seed(
@@ -135,19 +136,19 @@ async def reset_device(msg: ResetDevice) -> Success:
mnemonic_secret=secret,
)
- # write settings and master secret into storage
- if msg.label is not None:
- storage_device.set_label(msg.label)
- storage_device.set_passphrase_enabled(bool(msg.passphrase_protection))
- storage_device.store_mnemonic_secret(
- secret=secret, # for SLIP-39, this is the EMS
- needs_backup=not perform_backup,
- no_backup=bool(msg.no_backup),
- )
+ # write settings and master secret into storage
+ if msg.label is not None:
+ storage_device.set_label(msg.label)
+ storage_device.set_passphrase_enabled(bool(msg.passphrase_protection))
+ storage_device.store_mnemonic_secret(
+ secret=secret, # for SLIP-39, this is the EMS
+ needs_backup=not perform_backup,
+ no_backup=bool(msg.no_backup),
+ )
- # if we backed up the wallet, show success message
- if perform_backup:
- await layout.show_backup_success()
+ # if we backed up the wallet, show success message
+ if perform_backup:
+ await layout.show_backup_success()
return Success(message="Initialized") # TODO: Why "Initialized?"
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.