CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 39 Bitcoin

feat(solana): migrate to off-chain message signing v1

TZd289db4b View source ↗
Public commit record

What the developer wrote

Authored by Jakub Janků

100/100 · Strong
feat(solana): migrate to off-chain message signing v1

This commit completely removes support for Solana Off-Chain Message
Signing (OCMS) v0. This change follows the decision by Solana Foundation
(SF) to drop support for v0 and focus on v1 [1]. The motivation was that
v0 is flawed and its adoption is close to zero. However, note that not
all parties followed this decision fully: while Wallet Standard supports
v1 only (see [2]), Anza Docs [0] still list v0 as supported for
backwards compatibility.

Support for OCMS v1 is added instead. The protobuf interface is changed:
instead of accepting a serialized message in OCMS format, the device now
expects a structured protobuf message which it then serializes itself.
This again follows a decision by SF to shift the serialization
responsibility from dApps to wallets, see [1].

Moreover, the CLI is simplified as well. The "raw mode" of solana
sign-message (verify-message) commands which allowed the user to pass
a serialized OCMS message (envelope) is removed. This reflets the
protobuf interface change and makes the commands easier to use.

Fixes: https://github.com/trezor/trezor-firmware/issues/7053

[0] https://docs.anza.xyz/proposals/off-chain-message-signing

[1] https://app.notion.com/p/solanafoundation/OCMS-Meeting-June-3-2026-Notes-374d36dad52d80e3a517e5d2a8b29a2c

[2] https://github.com/anza-xyz/wallet-standard/pull/92
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit updates Trezor's Solana off-chain message signing feature from an older version (v0) to a newer version (v1). It changes how messages are packaged and sent to the device: instead of the computer app formatting the message and sending raw bytes, the device now receives a structured message and formats it itself. This is a feature migration, not a fix for an active security bug, but it removes support for the older format and changes the command-line interface. The change is described as following Solana Foundation's direction because v0 was considered flawed.

Recommended action

Review the new OCMS v1 serialization implementation for canonical encoding, signer sorting, duplicate handling, and length limits; verify that deprecated v0 fields cannot be misused by older clients; confirm UI still clearly displays the message and signer set before signing; and update integration tests and documentation to reflect the breaking protobuf/CLI change.

Security signals we found

01

Protocol version migration removes OCMS v0 parsing and envelope handling

02

Firmware now performs its own serialization of off-chain signing payloads, reducing trust in host-side formatting

03

Old protobuf field 2 (raw OCMS v0 bytes) is reserved/deprecated

04

Old SolanaVerifyMessage envelope field is reserved/deprecated

05

No explicit security bug or vulnerability is stated in the commit message or diff

Risk score

Why this scored 39/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 5/15
Affected reach 8/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Trezor firmware

Related watches

Low 33 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(python/trezorlib): enable entropy check on T1 by default

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only…

Enables a previously disabled security/validation feature (entropy check) for a specific device modelAdds version-gated behavior to avoid errors on older firmwareDefensive hardening of wallet setup randomness verification
a4af9107by Andrew Kozlik+10−42 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove scons related files

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cr…

a4b25c31by cepetr+5−927554 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

refactor(core): assorted micropython-1.28.0 fixes

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety A…

Synchronizes upstream MicroPython fixes that include buffer-size and stack-safety hardeningPrevents Ctrl+C interruption of frozen boot code, reducing denial-of-service/control-flow risk during bootFixes sys.stdout.buffer.write() return value, which could affect code relying on correct I/O semantics
7ba7879dby Martin Milata+36−4012 files
No security note in commit
Open full analysis →Source commit ↗