AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 38 Bitcoin

feat(core): reimplement THP event loop restarts

Public commit record

What the developer wrote

Authored by Roman Zeyde

57/100 · Thin
feat(core): reimplement THP event loop restarts

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit is a large internal refactor of the Trezor firmware's THP (Trezor Host Protocol) event loop and message handling. It removes an old global buffer-locking scheme and a separate retransmission task, replacing them with per-channel buffer objects and a simpler synchronous send-and-wait-for-ACK flow. The change also removes the old `loop.clear()` restart-on-error behavior in favor of explicitly joining workflows before restarting. The diff itself is a feature rewrite with no explicit security claims, but it touches sensitive code paths (encrypted channel setup, session scheduling, buffer management) and removes some safety checks, so it should be reviewed carefully for regressions.

Recommended action

Treat this as a high-risk refactor of a security-critical protocol stack. Run the full THP device test suite (especially `test_multiple_hosts.py`, handshake, pairing, and ABP tests) and perform a focused manual audit for: (1) use-after-free or buffer aliasing now that buffers are no longer locked per channel, (2) deadlocks or lost ACKs in the new synchronous send path, (3) unintended event loop restarts that could drop messages or sessions, and (4) any path where `write` can block indefinitely where `write_force` was previously required (e.g., reboot/wipe/pairing). No CVE or advisory is indicated by the commit itself.

Security signals we found

01

Removal of global buffer lock and timeout-based concurrency control in THP memory manager

02

Removal of `TransmissionLoop` retransmission task; send now waits synchronously for ACK

03

Removal of `loop.schedule()` for THP sessions and pairing contexts; messages are handled inline

04

Removal of `write_force` API; all writes go through normal `write` path

05

Change from catch-all `loop.clear()` on any exception to explicit `workflow.join_all()` then `loop.clear()`

06

New `Provider` pattern for two THP buffers means only two concurrent channels can reassemble payloads

07

Test expectations changed: concurrent handshake no longer relies on `LOCK_TIME` timeout but on buffer exhaustion

Risk score

Why this scored 38/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 6/15
Affected reach 8/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.