OSC-2026-0029 · github.com/trezor/trezor-firmware
none-found clean-run grok-4.5 2026-08-04 signed: nostr
- Repository
- github.com/trezor/trezor-firmware
- Commit
- 2b1938cc4d0d1c00d0c484a8b794e7758fe89f5b
- Model
- grok-4.5
- Harness
- grok-build
- Prompts
- prompts/tx-authorization-audit-v1.md
- Independent runs
- 1
- Transcript sha256
- 5a3fdbaa28139db166b51fc105536f91e89ca2bff9051ed267fbd162e3a87985
- Auditor
- TheIcarusWings (theicaruswings)
- Signature
- nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5
Scope. Independent tx-authorization audit of trezor-firmware at 2b1938cc. In scope: Bitcoin SignTx change detection (ChangeDetector + seed-derived scripts), prevtx amount verification, fee thresholds, stream consistency digests (h_tx_check), multisig cosigner fingerprint, get_address derivation, vendor-header firmware sig checks. Out of scope: altcoin-specific forks beyond base Bitcoin signer, CoinJoin policy depth, USB framing parsers, UI chrome. Same commit as OSC-2026-0027 entropy run; different lens.
Findings
none-found OSC-2026-0029-F1 unreviewed
No transaction-authorization defect found in scope. Change outputs require seed-derived scriptPubKey plus multi-factor match (wallet path, script type, full multisig fingerprint); failures become external outputs shown to the user. Non-taproot-only flows re-verify input amounts against previous transactions. Fee over maxfee threshold requires confirmation. Signing re-checks stream digests so approval and sign cannot diverge silently.