OpenSourceCheck

OSC-2026-0029 · github.com/trezor/trezor-firmware

none-found clean-run grok-4.5 2026-08-04 signed: nostr

Repository
github.com/trezor/trezor-firmware
Commit
2b1938cc4d0d1c00d0c484a8b794e7758fe89f5b
Model
grok-4.5
Harness
grok-build
Prompts
prompts/tx-authorization-audit-v1.md
Independent runs
1
Transcript sha256
5a3fdbaa28139db166b51fc105536f91e89ca2bff9051ed267fbd162e3a87985
Auditor
TheIcarusWings (theicaruswings)
Signature
nostr-schnorr · npub19tzp8lf3klmqj3dz9mz0qnuvjp7uyy9993gmljmyaxs8phztj7wsnujvq5

Scope. Independent tx-authorization audit of trezor-firmware at 2b1938cc. In scope: Bitcoin SignTx change detection (ChangeDetector + seed-derived scripts), prevtx amount verification, fee thresholds, stream consistency digests (h_tx_check), multisig cosigner fingerprint, get_address derivation, vendor-header firmware sig checks. Out of scope: altcoin-specific forks beyond base Bitcoin signer, CoinJoin policy depth, USB framing parsers, UI chrome. Same commit as OSC-2026-0027 entropy run; different lens.

Findings

none-found OSC-2026-0029-F1 unreviewed

No transaction-authorization defect found in scope. Change outputs require seed-derived scriptPubKey plus multi-factor match (wallet path, script type, full multisig fingerprint); failures become external outputs shown to the user. Non-taproot-only flows re-verify input amounts against previous transactions. Fee over maxfee threshold requires confirmation. Signing re-checks stream digests so approval and sign cannot diverge silently.

core/src/apps/bitcoin/sign_tx/change_detector.py:45-68; core/src/apps/bitcoin/sign_tx/bitcoin.py:241-278,543-551,961-982; core/src/apps/bitcoin/sign_tx/approvers.py:345-362; core/src/apps/bitcoin/multisig.py:15-50; core/src/apps/bitcoin/sign_tx/tx_info.py:53-93