Trezor firmware

This commit is a straightforward code cleanup: it moves helper functions for formatting Stellar Soroban smart-contract values and showing confirmation screens from one file to another shared file. No security behavior changes are visible in the diff. The only functional tweak is narrowing an exception handler from a broad 'except Exception' to 'except OverflowError' when formatting timestamps, which is a minor hardening improvement, not a vulnerability.

This commit updates Trezor's Stellar/Soroban smart-contract support to match a newer Stellar protocol version (Protocol 27). It renames the credential type from the older SOROBAN_CREDENTIALS_ADDRESS to SOROBAN_CREDENTIALS_ADDRESS_V2 and updates the related field name from address to address_v2 across the firmware, Python library, Rust client, and tests. The older credential type is intentionally no longer supported. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a routine protocol compatibility update.

This commit adds a new feature to Trezor's Ethereum 'clear signing' system that lets wallet definitions extract a slice of bytes from a numeric parameter. For example, a 32-byte number that secretly packs an address into its last 20 bytes can now be sliced so the device shows only the real address. The change is described as a feature, not a bug fix, and there is no vendor statement that it fixes a security vulnerability. It does reduce one real risk: users could otherwise be tricked into approving transactions where hidden extra bits in a number change the meaning of what they see on screen.

This commit adds a new user-facing safety feature for Trezor hardware wallets when signing Ethereum transactions. If the user chooses to view all the raw transaction data (calldata), the device will now also show a final cryptographic hash (digest) of that data, based on a community standard called ERC-8213. This helps users verify that what they saw on screen matches what is actually being signed, reducing the risk of hidden malicious changes in very long data fields. It is a defensive improvement, not a fix for an active bug or vulnerability.

This commit only changes a test data file. It removes duplicate 'skip_models' entries from Ethereum EIP-7702 test fixtures so that the T2T1 model is no longer excluded from these tests. There is no change to firmware code, no security fix, and no user-facing behavior change.

This commit adds support for signing Ethereum EIP-7702 authorizations and revocations on Trezor hardware wallets. EIP-7702 lets an Ethereum account temporarily delegate control to a smart contract. The code adds a new signing workflow, user confirmation screens, and command-line support. It is a feature addition, not a fix for a known vulnerability. The main security consideration is that authorizing delegation is a powerful operation, so the code requires users to disable strict safety checks and confirm on the device, while revocation remains allowed under strict checks.

This commit only edits changelog text. It adds a more precise description of an already-released Ethereum feature (EIP-7702 support) and removes an older, less accurate changelog line. No code, transaction logic, or cryptographic behavior is changed, so there is no security issue in this commit itself.

This commit adds support for more Ethereum data types in Trezor's clear signing feature. It introduces parsing for signed 160-bit integers (int160) and fixed-size byte arrays of various lengths (bytes4, bytes8, bytes16, bytes20, bytes32). The code also refactors existing parsers to use shared factory functions. The changes are primarily feature additions with built-in validation checks, and there is no direct evidence in the commit of a security vulnerability or fix.

This commit updates the Trezor Ethereum 'clear signing' feature so that when a known DeFi contract (like 1inch or Uniswap) is recognized, the device screen shows the provider's human-readable name (e.g., '1inch Aggregation Router V6') instead of just a raw address or a generic vault label. It also updates some URL comments to point to the community ERC-7730 registry rather than Ledger's copy. There is no obvious security vulnerability in the change; it is a user-experience improvement for transaction clarity.

This commit adds a new optional 'provider_name' field to the data structure used for Ethereum 'clear signing' on Trezor devices. When a provider name is supplied, the device will show that name instead of the usual recipient address lookup during transaction confirmation. The change itself is a feature addition, but it creates a new channel where a connected computer could tell the Trezor screen to display an arbitrary label for the recipient. There is no evidence in the commit that the input is validated, length-limited, or checked against the actual blockchain address, which could allow a malicious or compromised host application to mislabel a transaction recipient.

This commit adds user-friendly on-screen labels for wrapping and unwrapping Ether using the popular WETH token contract on several Ethereum-like networks. It does not change transaction security rules; it only makes the device show clearer messages such as 'Wrap ETH to WETH' instead of raw contract data. There is no indication of a vulnerability being fixed.

This commit updates Trezor's Solana off-chain message signing feature from an older version (v0) to a newer version (v1). It changes how messages are packaged and sent to the device: instead of the computer app formatting the message and sending raw bytes, the device now receives a structured message and formats it itself. This is a feature migration, not a fix for an active security bug, but it removes support for the older format and changes the command-line interface. The change is described as following Solana Foundation's direction because v0 was considered flawed.

This commit is a routine version bump from 2.12.3 to 2.12.4 for the Trezor firmware. It only changes the version number in one header file and updates the same version number in translation files, plus refreshes the translation signature metadata. There are no code behavior changes, no bug fixes, and no security-related modifications visible in the diff.

This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner could be hidden from the user, allowing an attacker to later seize funds sent to the freshly created account. The fix is purely a user-interface change on the hardware wallet screen, not a change to Solana itself.

This commit adds a new line on the Trezor screen when authorizing a CoinJoin: it now shows the 'Max coordinator fee rate' alongside the existing 'Max rounds' and 'Max mining fee'. This is a user-interface improvement that gives the device owner more information before they approve a CoinJoin session. It does not change any security logic, fee enforcement, or authorization checks; it only displays an extra value that was already part of the authorization message.

This commit fixes a misleading display on Trezor hardware wallets when a user initializes a Solana multisig account. Previously, the device only showed the list of possible signers without showing how many signatures were actually required to approve transactions. This made a 1-out-of-N multisig look like an N-out-of-N multisig, which could trick a user into thinking funds or token operations were safer than they really were. The patch now displays the threshold number (M) so the user sees, for example, '1 of 3 signers required' rather than just '3 signers'.

This update tightens a Solana staking flow in Trezor firmware so that the device now verifies the staking account is owned by the legitimate Stake program before showing the user a friendly confirmation screen. Previously, a crafted transaction with a different owner could slip through the predefined staking prompt, though the Solana network itself would likely reject it. The change also fixes a missing display option in the claim flow.

This commit fixes a bug in how Trezor firmware parses Ethereum transaction data for 'clear signing' of complex smart-contract calls. The parser previously misread arrays of simple structs (e.g., lists of token-swap details) because it assumed every struct element was stored via an offset pointer, which is only true for structs containing variable-length data. With the correct ABI behavior, static structs are now read directly in sequence. The bug could cause Trezor to display wrong values or fall back to blind signing, but it does not leak private keys or directly steal funds. The fix also hardens parsing against malformed empty structs and out-of-bounds reads.

This commit fixes how Trezor firmware parses certain Ethereum transaction data types—specifically arrays of byte blobs (bytes[]) and arrays of strings (string[])—when showing clear signing details on the device screen. Before the fix, the code would follow an offset pointer twice, likely reading the wrong memory location and producing incorrect decoded values. That could cause the Trezor to display misleading transaction details to the user, potentially tricking them into approving a transaction that does what the screen does not show.

This commit removes unused code and unreachable safety checks from the Ethereum clear-signing module. The removed function (parse_uint256_array) was never actually used, and the type-check guards it supported could never be triggered. There is no evidence this change fixes or introduces a security vulnerability; it is a code cleanup.

This is a pure code cleanup: it replaces hard-coded '32' values with a named constant, renames a class from 'Dynamic' to 'DynamicLeaf' for clarity, and renames a variable for readability. The commit message explicitly says 'no behavior change' and there is no functional change visible in the diff.

This commit adds support for signing Stellar Soroban smart-contract transactions on Trezor hardware wallets. It introduces new message types, on-device confirmation screens, and serialization logic for complex contract arguments and authorization trees. The change is a feature addition rather than a bug fix; it does not by itself fix a known vulnerability, but it does expand the attack surface of the Stellar signing flow and includes several security-relevant design choices (e.g., showing externally signed authorizations only on request).

This commit removes built-in, hard-coded display rules for the LI.FI swap/bridge protocol from Trezor's Ethereum 'clear signing' feature. It is a feature cleanup, not a fix for a code vulnerability. The change means Trezor will no longer automatically show friendly LI.FI transaction labels unless the user or wallet later loads an external definition file. The commit itself does not introduce a security bug, but it slightly changes how users verify LI.FI transactions on the device screen.

This commit is purely a test-data update for Trezor's Ethereum 'clear signing' feature. It removes old built-in test fixtures and adds new externally-supplied token/chain definition files so the test suite can exercise how the device handles user-provided definitions. There is no change to firmware, wallet logic, or security-critical code.

This is a test-only refactoring commit. It changes how Ethereum function signatures are represented in firmware source code (from hex strings converted at runtime to raw byte literals) and updates the corresponding unit test to verify those signatures against Solidity function definitions. There is no runtime behavior change and no security fix or vulnerability.