feat: add trezor receive

[ben-kaufman]

Summary

• open the existing Receive sheet on a Trezor tab from the paired hardware-wallet screen
• render the watcher-provided next-unused address immediately, with an account-scan fallback
• support safe amount/message editing on the hardware address and exact on-device verification
• match the receive design with a white selected underline, blue hardware QR/action accents, and verification inside Show Details

Stack

• Based on Send PR feat: add trezor send #688
• Uses Bitkit Core v0.5.10 from bitkit-core #147

Linked Issues/Tasks

Fixes #707

Validation

• iPhone 16 simulator build passes against Core 0.5.10
• focused watcher receive-address test passes
• SwiftFormat passes

[greptile-apps]

Greptile Summary

Adds Trezor receiving to the existing receive sheet, using watcher-provided addresses with an account-scan fallback and optional on-device verification.

• Opens receive directly on the Trezor tab from a hardware-wallet screen.
• Supports amount and message parameters for hardware-wallet BIP21 requests.
• Adds reconnect, pairing-code, and passphrase handling for device verification.
• Updates Bitkit Core to 0.5.10 and extends watcher-event handling for next-unused addresses.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking defects identified.

The receive flow preserves explicit hardware-wallet identity from its primary entry point, obtains a next-unused address through watcher or account-scan state, and rejects device verification unless the returned address exactly matches the displayed destination.

Important Files Changed

Filename	Overview
Bitkit/Managers/HwWalletManager.swift	Stores watcher-provided next-unused addresses, adds account-scan fallback, and verifies the displayed derivation directly on the Trezor.
Bitkit/Views/Wallets/Receive/ReceiveQr.swift	Adds the Trezor receive tab, hardware BIP21 rendering, address loading, and reconnect/passphrase-aware verification.
Bitkit/Views/Wallets/Receive/ReceiveEdit.swift	Adds an on-chain-only editing mode that preserves amount and message state without invoking Lightning or Paykit flows.
Bitkit/Views/Wallets/Receive/ReceiveSheet.swift	Carries hardware-wallet identity through receive navigation and presents pairing requests during reconnect.
Bitkit/Components/TabBar/TabBar.swift	Opens the receive sheet on the Trezor tab when invoked from a hardware-wallet route.
Bitkit.xcodeproj/project.xcodeproj	Updates Bitkit Core to the version providing the watcher receive-address payload.

Sequence Diagram

sequenceDiagram
    participant User
    participant Receive as Receive Sheet
    participant Manager as Hardware Wallet Manager
    participant Watcher as Watch-only Watcher
    participant Electrum
    participant Trezor
    User->>Receive: Open Trezor receive tab
    Receive->>Manager: Request receive address
    Manager->>Watcher: Read cached next-unused address
    alt Watcher address available
        Watcher-->>Manager: Address and derivation path
    else Watcher address unavailable
        Manager->>Electrum: Scan account addresses
        Electrum-->>Manager: First unused external address
    end
    Manager-->>Receive: Address and derivation path
    Receive-->>User: Display QR and details
    opt Verify on device
        User->>Receive: Verify address
        Receive->>Manager: Verify displayed address
        Manager->>Trezor: Derive and display exact path
        Trezor-->>Manager: Device-derived address
        Manager-->>Receive: Accept only exact match
    end

Loading

_{Reviews (1): Last reviewed commit: "feat: add trezor receive" | Re-trigger Greptile}

[piotr-iohk]

Tested on simulator and device (iPhone 13 + Trezor Safe 7).

Generally all good. Able to present the receive address, verify the address on the device, etc.

One observation (looks intentional in code, but may be misleading to the user): with 2+ paired hardware wallets (e.g. standard + passphrase), Home → Receive does not show the Trezor tab, so there is no hardware receive address from that entry point. Fine to defer to a follow-up PR — if that's the case, let's create a ticket for this.

Steps to reproduce

1. Pair a Trezor (standard wallet). Home should show one hardware wallet tile.
2. Add a passphrase wallet on the same device (Paired → Passphrase → enter passphrase). Home should now show two hardware wallet tiles.
3. From the main/home screen, tap Receive.
4. Only Savings / Spending tabs are shown. No Trezor tab, so you cannot get a hardware receive address.

Expected (or less misleading)

Home → Receive either shows a Trezor tab (or a wallet picker) when more than one hardware wallet is paired, or makes it clear that hardware receive is only available from the specific wallet screen.

Workaround

Open the specific hardware wallet screen first, then Receive. That path still shows the address.

Recording

ScreenRecording_09-01-2026.10-03-56_1.MP4

[piotr-iohk]

Approve. Single-wallet receive looks good on simulator and device. See the QA comment for the multi-wallet Home Receive note (fine to defer).

The base branch was changed.

[ben-kaufman]

The single-wallet hardware Receive flow remains green and its review threads are resolved. I filed #709 for the requested Home Receive wallet picker when multiple hardware wallets are paired. @piotr-iohk please re-review the current signed head because the earlier approval was dismissed after the branch update.

[ovitrif]

utACK

[ben-kaufman]

@ovitrif Thanks, I tested this again on a clean iPhone 17 simulator using exact head e4e60971. I stored two distinct Trezor wallets so the single-wallet fallback could not mask a missing route ID, then opened Receive from HardwareWalletScreen.

Both the connected wallet and a disconnected wallet named “Bitkit Test Trezor” correctly showed the Trezor, Savings, and Spending tabs. Show Details also exposed HardwareVerifyAddress (“Verify on Device”).

I couldn’t reproduce the reported behavior. Seeing only Savings and Spending matches the pre-#693 build, so could you please remove the installed app/clean the build and retry with e4e60971? If it still occurs, please share the exact navigation steps and build commit so I can investigate that specific path.

[piotr-iohk]

Retested current head e4e60971 on iPhone 13 + Trezor Safe 7 and on the Trezor emulator.

I do not see the missing Tab-trezor issue on my side. Opening Receive from the hardware-wallet screen still shows the Trezor tab, the hardware address, and Verify on Device.

If that report was from Home → Receive with 2+ paired Trezors, that is the already-known case: Home Receive hides Tab-trezor when more than one hardware wallet is paired (filed as #709). That is separate from receive opened from the hardware-wallet screen.

E2E now covers this path as well (@hardware_wallet_2): it opens Receive, waits for Tab-trezor, and funds the Trezor-tab address.

LGTM.

[piotr-iohk]

@ovitrif is this good to merge from your side? There's "Request change" mark from you on the PR. - not sure if it is still intentional.

known issue