fix(security): on-device TX parsing for TRON, blind-sign warnings for TON/Solana#52
Closed
BitHighlander wants to merge 2 commits intodevelopfrom
Closed
fix(security): on-device TX parsing for TRON, blind-sign warnings for TON/Solana#52BitHighlander wants to merge 2 commits intodevelopfrom
BitHighlander wants to merge 2 commits intodevelopfrom
Conversation
Addresses security audit findings for TRON, TON, and Solana signing: TRON (CRITICAL fix): - Add minimal protobuf parser to extract TransferContract fields (to_address, amount) directly from the signed raw_data payload - Simple TRX transfers now show on-device-verified details - Token/contract TXs fall through to explicit blind-sign warning TON (blind-sign warning): - TON Cell/BoC encoding cannot be parsed on-device - Add explicit "Blind Signature" warning so users know TX details are host-asserted and unverifiable Solana (multi-instruction + message signing): - Only show parsed transfer details for single-instruction system transfers (num_instructions == 1) - Multi-instruction and unknown programs get blind-sign warning - Remove show_display=false bypass for message signing — always require user confirmation
…ount TRON: Add pb_count_field() to verify exactly one contract entry in raw_data before showing parsed transfer details. Multiple contracts now fall through to blind-sign (prevents hiding malicious contracts behind a benign first TransferContract). Solana: Add total_instructions field to SolanaParsedTransaction (actual count from TX, not capped at 8). Use it for the single-instruction guard and blind-sign warning display.
6 tasks
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Audit Findings Addressed
TRON — parse TransferContract from signed payload (CRITICAL)
Previously: device displayed host-supplied
to_address/amountthen signed unrelatedraw_databytes. A malicious host could show a benign transfer while signing a drain.Fix: Added minimal protobuf parser (
tron_parseTransfer()) that extractsto_addressandamountdirectly from the signedraw_datapayload for TransferContract (type 1). Simple TRX transfers now show on-device-verified details. Token/contract TXs get explicit blind-sign warning.TON — explicit blind-sign warning (HIGH)
TON uses Cell/BoC encoding which cannot be feasibly parsed on an embedded device. Added explicit "Blind Signature" warning text so users understand TX details are host-asserted and unverifiable on-device. (On-device Cell parsing is a future improvement.)
Solana — multi-instruction fix + message signing (HIGH)
num_instructions == 1AND instruction is a system transfer. Previously showed parsed details for first instruction even in multi-instruction TXs, hiding potentially malicious subsequent instructions.show_display=falsebypass for message signing — user confirmation is always required since signed messages can authorize on-chain actions.Test plan