fix(core/bootloader): increase wipe bonds timeout
What the developer wrote
Authored by tychovrahe
fix(core/bootloader): increase wipe bonds timeout
[no changelog]
What changed, and why it matters
This commit increases a timeout in the Trezor bootloader from 100 to 300 ticks while wiping Bluetooth pairing information ('bonds'). A too-short timeout could cause the wipe operation to fail or behave inconsistently if the Bluetooth chip takes longer to respond. The change is a hardening fix, not a clear-cut vulnerability patch, and the commit message does not describe any security impact.
Treat as a minor hardening improvement. If auditing, verify whether the original 100-tick timeout could allow incomplete bond erasure under realistic timing conditions, and confirm that 300 ticks covers worst-case BLE response latency. No urgent action required absent additional evidence of exploitable failure.
Security signals we found
Timeout value increased in a security-sensitive wipe workflow
Change located in bootloader, which has elevated privileges and limited recovery options
No changelog entry and minimal commit message reduce transparency
Evidence from the diff
In core/embed/projects/bootloader/workflow/wf_wipe_device.c, the deadline for wipe_bonds() is extended from ticks_timeout(100) to ticks_timeout(300). The function loops querying BLE state and presumably waits for a response before proceeding. A short deadline could lead to premature exit from the loop, leaving bonded devices intact or producing an incomplete wipe. The patch is a single-constant change with no additional error handling or logging.
Changed components
Trezor core bootloaderBluetooth LE bond wipe workflow (wf_wipe_device.c)Inspect captured patch +1 / −1
diff --git a/core/embed/projects/bootloader/workflow/wf_wipe_device.c b/core/embed/projects/bootloader/workflow/wf_wipe_device.c
index 143cbec8..209c2141 100644
--- a/core/embed/projects/bootloader/workflow/wf_wipe_device.c
+++ b/core/embed/projects/bootloader/workflow/wf_wipe_device.c
@@ -63,7 +63,7 @@ static bool wipe_bonds(protob_io_t* iface) {
return false;
}
- uint32_t deadline = ticks_timeout(100);
+ uint32_t deadline = ticks_timeout(300);
while (true) {
ble_get_state(&state);
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.