Trezor

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (Trezor devices and firmware; "In exceptionally critical cases, there is no upper reward limit") │ $10,000 - $100,000 │ $11,000 - $101,000 High (Trezor devices and firmware) │ $500 - $10,000 │ $625 - $11,000 Medium (Trezor devices and firmware) │ $250 - $5,000 │ $313 - $6,000 Low (Trezor devices and firmware) │ $0 - $2,000 │ $0 - $2,500 Submit a vulnerability CVE history 6 Last 12 months Auth bypass 30 % Memory safety 25 % Parsing/validation 25 % Info disclosure 15 % Latest advisories Loading the feed Overview Trezor is one of the two hardware wallets that define the category, with a shipped-device population in the millions across the Trezor One, Model T and the Safe 3/5/7 line. Its blast radius is considerably wider than its own device count, because trezor-firmware is the reference implementation for BIP-39, SLIP-39 Shamir backup, SLIP-0010, SLIP-0044 and the SLIP family generally, and its crypto/ directory and coin definitions are vendored or copied by a long tail of other wallets and libraries, a defect in Trezor's transaction-parsing or signing paths tends to reappear in third-party software that borrowed the code. The program is unusual in the right direction: the open GPLv3/LGPLv3/MIT firmware is the top reward tier rather than the bottom, at $10,000 to $100,000 for a Critical with the note that "In exceptionally critical cases, there is no upper reward limit", then $500 to $10,000 for a High, $250 to $5,000 for a Medium and up to $2,000 for a Low. The other product rows are lower: Trezor Suite and Trezor Connect are in scope and paid but cap at $20,000 and ship under a proprietary licence, and Blockbook, the AGPL-3.0 backend indexer, caps at $10,000. Only the first valid submission counts, proof-of-concept code is required, and severity is at Trezor's discretion. The program is also unusually transparent, publishing the resolved reports themselves, six carry 2026 dates. sorona.xyz adds 1.25× on top of whatever Trezor awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Trezor devices and their firmware, the first of the program's four asset categories and the one it calls by far the most important, covering the hardware, the firmware on it, physical device security and device-level supply-chain integrity trezor/trezor-firmware in full, which its own LICENSE.md splits into core and legacy (the firmware for the current line and for the Trezor One), storage (the PIN-protected encrypted storage), crypto (the MIT primitives), common (the coin definitions) and python The device surfaces that firmware drives: the bootloader and the firmware-update verification behind it, PIN and passphrase entry, seed generation and backup under BIP-39 and SLIP-39, per-coin transaction and message parsing and signing, the USB and host transport, and the confirmation screen a user approves against The hardware as a physical object, from non-invasive techniques through "Evil Maid" scenarios to chip decapping, and tampering with devices or accessories before they reach the buyer Trezor Suite and Trezor Connect, in scope and paid on their own row up to $20,000 at Critical, shipped under the proprietary TREZOR REFERENCE SOURCE LICENSE rather than an open one Blockbook and the backend infrastructure, AGPL-3.0, on a row capping at $10,000 at Critical The trezor.io e-shop, on a row capping at $50,000 at Critical Out of scope Clickjacking and tabnabbing with no direct security impact on the device Phishing and social engineering that does not exploit a technical vulnerability Missing security headers without a working exploitable proof of concept Output of automated vulnerability scanners Issues already publicly reported, or already known to Trezor Anything whose only effect is a host-side display discrepancy, since the threat model already assumes "the host can be fully malicious and transactions need to be confirmed on Trezor's display" Second and later reports of the same issue: only the first valid submission is paid, and severity sits at Trezor's discretion Most-valued findings Unauthorised seed extraction or injection, or private-key extraction from the device. This is the top of the firmware band and the finding the program says matters most, because the device is "the ultimate point of security in our threat model" and everything else assumes it holds PIN or lock bypass, and bypass of the on-device transaction confirmation. Auth bypass is 30% of the class distribution here, and the record backs it: a 2026 disclosure covers signing after LockDevice or autolock in an SD-protect-only configuration Confirmation-screen mismatches, where the device signs something other than what the user approved. Trezor disclosed exactly this in May 2026, when the SLIP-24 payment-request branch in production firmware signed attacker calldata under a verified-swap interface Arbitrary code execution on the device without a firmware warning, the 25% memory-safety class landing on the one surface whose integrity the whole product is sold on Parsing and validation failures in transaction, message and PSBT decoding, the other 25% class and the one whose blast radius exceeds Trezor: trezor-firmware is the reference implementation for the SLIP family and its crypto/ directory is vendored by other wallets Unauthenticated remote resource exhaustion, which the 2026 index carries twice in one month: memory exhaustion through an unbounded timestamp array, and a denial of service through xpub change-index amplification Physical attacks recovering secrets from a device an attacker briefly held, from glitching and "Evil Maid" setups to decapping, alongside loss of plausible deniability on the hidden-wallet passphrase, a guarantee some users have staked their physical safety on rather than merely their funds Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Proof-of-concept code is required with the report First valid submission only; a duplicate of something already reported earns nothing Severity, and therefore the band you land in, is at Trezor's discretion The threat model assumes the host can be fully malicious and that transactions are confirmed on Trezor's own display, so a host-side display discrepancy on its own is not a finding The $100,000 band attaches to the device and its firmware; Trezor Suite and Trezor Connect cap at $20,000 and Blockbook and backend infrastructure cap at $10,000 Give Trezor time to fix the issue before disclosing it publicly; an encrypted Signal channel is available for material too sensitive for email Disclosure Coordinated directly with Trezor, which then publishes the resolved report itself at trezor.io/vulnerability/: six such pages carry 2026 dates, so disclosure here is expected rather than discouraged, it just runs on Trezor's clock. Hold your write-up until their page is up; sorona.xyz holds the finding until then. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability