AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

fix(core): mark THP `app_name` and `host_name` with yellow

Public commit record

What the developer wrote

Authored by Roman Zeyde

70/100 · Adequate
fix(core): mark THP `app_name` and `host_name` with yellow

Fixes #5557.

[no changelog]
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This commit changes how the Trezor hardware wallet displays pairing and connection prompts for its new Bluetooth-like 'THP' protocol. Instead of building the prompt sentence in Python code, it now uses a dedicated Rust UI screen that highlights the app name and host name in yellow. This is a user-experience and anti-phishing improvement, not a fix for a remotely exploitable vulnerability. The change only affects on-screen text formatting and which UI component is used; it does not change cryptographic checks, authorization logic, or data parsing.

Recommended action

No immediate security action required. Treat as a normal UX/anti-phishing improvement. Reviewers may want to verify that the new `confirm_thp_pairing` screen preserves the same cancel/confirm behavior and that the `args` vector length is properly bounded (the diff shows `heapless::Vec<TString, 2>` and an `OutOfRange` error on missing args, which is appropriate).

Security signals we found

01

UI highlighting change for untrusted host/app identifiers (anti-spoofing UX signal)

02

Refactor of THP pairing confirmation screen implementation

03

New Rust UI API `confirm_thp_pairing` added to firmware_micropython.rs

04

Translation keys added for THP prompts; only Eckhart layout has non-empty strings

05

No cryptographic, parsing, or authorization logic changes observed

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.