AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

feat(bolt): SLIP-24 payment requests

Public commit record

What the developer wrote

Authored by Ioan Bizău

57/100 · Thin
feat(bolt): SLIP-24 payment requests

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit adds on-device user-interface support for SLIP-24 payment requests on the Trezor Model T (Bolt layout). It does not change transaction validation, cryptography, or signing logic. Instead, it wires up new confirmation screens so users can review payment-request details (provider, refund addresses, swap/trade details, fees) before signing. Existing tests that previously skipped Model T are now enabled for it, and new UI test hashes are recorded. There is no direct evidence of a security vulnerability in this patch.

Recommended action

No immediate security action is required. Treat as a normal feature commit. If auditing, verify that the new `confirm_payment_request` flow correctly displays all security-critical fields (recipient, refund addresses, trade amounts, fees) and that user confirmation is required before signing. Also confirm that `external_menu`/`info` button behavior cannot be abused to hide or bypass confirmation pages.

Security signals we found

01

UI-only feature enablement for SLIP-24 payment requests on Model T

02

Previously stubbed parameters (verb, external_menu) now take effect in Bolt layout

03

New confirmation flows for provider, refund, swap/trade, and fee details

04

No changes to signature, MAC, or transaction validation logic visible in diff

05

Test coverage expanded but only for expected-success and expected-failure UI flows

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.