What the developer wrote
Authored by Roman Zeyde
chore: update signed secmon
Built from 764df17
(cherry picked from commit 725c0c01879329900f08fc453d8fd0fcb4d86090)
What changed, and why it matters
This commit replaces a binary firmware component called 'secmon.bin' for the T3W1 hardware model. The change is a pre-built binary blob with no source diff, so from the commit alone we cannot tell what security relevance, if any, the update has.
Treat as unreviewable from a security standpoint based on this commit alone. If assessing risk, obtain the source changes from commit 764df17 (build source) and 725c0c01879329900f08fc453d8fd0fcb4d86090 (cherry-pick source), verify the binary signature, and review the Secure Monitor source diff for memory safety, boot/secure-state handling, and cryptographic operations.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit updates core/embed/models/T3W1/secmon/secmon.bin, a signed Secure Monitor binary for the T3W1 model. The diff only shows a binary file addition/replacement (mode change from /dev/null). No source changes, changelog, security notes, or build metadata beyond ‘Built from 764df17’ are present. The referenced source commit 725c0c01879329900f08fc453d8fd0fcb4d86090 is mentioned as the cherry-pick source but its contents are not supplied.
Changed components
core/embed/models/T3W1/secmon/secmon.binInspect captured patch +0 / −0
diff --git a/core/embed/models/T3W1/secmon/secmon.bin b/core/embed/models/T3W1/secmon/secmon.bin
new file mode 100644
index 00000000..7e06a5dc
Binary files /dev/null and b/core/embed/models/T3W1/secmon/secmon.bin differ
Why this scored 3/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.