fix(core): change default autolock timeout to 40 s
What the developer wrote
Authored by matejcik
fix(core): change default autolock timeout to 40 s
it was a todo
What changed, and why it matters
This commit changes the default battery autolock timeout on Trezor hardware wallets from 20 seconds to 40 seconds. The previous 20-second default was apparently a placeholder (noted in a TODO comment). A longer autolock delay means the device stays unlocked a bit longer when on battery power, slightly increasing the window for physical-access attacks, but the change is minor and matches the intended design.
No action required; treat as a minor product-hardening/configuration cleanup. Review whether 40 seconds remains the desired default for battery autolock and ensure documentation matches.
Security signals we found
Default autolock timeout increased, marginally enlarging the physical-access attack window
TODO comment removed, indicating the prior value was a known placeholder
Evidence from the diff
In core/src/storage/device.py, AUTOLOCK_DELAY_BATT_DEFAULT_MS is changed from const(20 * 1000) to const(40 * 1000). The old value was accompanied by a TODO saying it should be 40 s, despite the code comment also claiming 40 seconds. This is a configuration-only change that aligns the default with the documented intent.
Changed components
core/src/storage/device.pyTrezor Core power-manager autolock defaultInspect captured patch +1 / −1
diff --git a/core/src/storage/device.py b/core/src/storage/device.py
index 81d7b18ad..e3e2b4a0d 100644
--- a/core/src/storage/device.py
+++ b/core/src/storage/device.py
@@ -68,7 +68,7 @@ AUTOLOCK_DELAY_USB_MAX_MS = const(0x2000_0000) # ~6 days
if utils.USE_POWER_MANAGER:
AUTOLOCK_DELAY_BATT_MIN_MS = 30 * 1000 # 30 seconds
- AUTOLOCK_DELAY_BATT_DEFAULT_MS = const(20 * 1000) # 40 seconds TODO: change to 40s
+ AUTOLOCK_DELAY_BATT_DEFAULT_MS = const(40 * 1000) # 40 seconds
AUTOLOCK_DELAY_BATT_MAX_MS = const(10 * 60 * 1000) # 10 minutes
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.