ethereum: extract total fee verification helpers
What changed, and why it matters
This commit is a simple code cleanup: it moves two existing blocks of Ethereum fee-verification logic into new helper functions without changing what the code actually does. There is no visible security fix or behavior change.
No security action needed; treat as routine refactoring.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch extracts inline fee/total verification logic from verify_erc20_transaction and verify_standard_transaction into two new async helpers, verify_erc20_total_fee and verify_standard_total_fee. The same calls to parse_fee, Amount::add, calculate_percentage, and transaction::verify_total_fee_maybe_warn are preserved with identical arguments. No logic, validation, or arithmetic was altered.
Changed components
src/rust/bitbox02-rust/src/hww/api/ethereum/sign.rsInspect captured patch +31 / −11
diff --git a/src/rust/bitbox02-rust/src/hww/api/ethereum/sign.rs b/src/rust/bitbox02-rust/src/hww/api/ethereum/sign.rs
index 2ba70a6..31242cc 100644
--- a/src/rust/bitbox02-rust/src/hww/api/ethereum/sign.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/ethereum/sign.rs
@@ -135,6 +135,35 @@ fn parse_erc20(request: &Transaction<'_>) -> Option<([u8; 20], BigUint)> {
))
}
+async fn verify_erc20_total_fee(
+ hal: &mut impl crate::hal::Hal,
+ request: &Transaction<'_>,
+ params: &Params,
+ formatted_total: &str,
+) -> Result<(), Error> {
+ let formatted_fee = parse_fee(request, params).format();
+ transaction::verify_total_fee_maybe_warn(hal, formatted_total, &formatted_fee, None).await?;
+ Ok(())
+}
+
+async fn verify_standard_total_fee(
+ hal: &mut impl crate::hal::Hal,
+ request: &Transaction<'_>,
+ params: &Params,
+ amount_value: &BigUint,
+) -> Result<(), Error> {
+ let fee = parse_fee(request, params);
+ let total = Amount {
+ unit: params.unit,
+ decimals: WEI_DECIMALS,
+ value: amount_value.add(&fee.value),
+ };
+ let percentage = calculate_percentage(&fee.value, amount_value);
+ transaction::verify_total_fee_maybe_warn(hal, &total.format(), &fee.format(), percentage)
+ .await?;
+ Ok(())
+}
+
// For legacy transactions: `fee = gas limit * gas price`
// For 1559 transactions: `fee = gas limit * max fee per gas` where max fee per gas is composed of the base fee + priority fee
// In both instances we show the user the max possible fee, but the actual fee paid at execution might be lower
@@ -220,7 +249,6 @@ async fn verify_erc20_transaction(
erc20_value: BigUint,
) -> Result<(), Error> {
let erc20_params = erc20_params::get(params.chain_id, parse_recipient(request.recipient())?);
- let formatted_fee = parse_fee(request, params).format();
let recipient_address = super::address::from_pubkey_hash(&erc20_recipient, request.case()?);
let recipient_address_display = super::address::format_display_address(&recipient_address);
let (formatted_value, formatted_total) = match erc20_params {
@@ -240,7 +268,7 @@ async fn verify_erc20_transaction(
hal.ui()
.verify_recipient(&recipient_address_display, &formatted_value)
.await?;
- transaction::verify_total_fee_maybe_warn(hal, &formatted_total, &formatted_fee, None).await?;
+ verify_erc20_total_fee(hal, request, params, &formatted_total).await?;
Ok(())
}
@@ -322,15 +350,7 @@ async fn verify_standard_transaction(
.verify_recipient(&address_display, &amount.format())
.await?;
- let fee = parse_fee(request, params);
- let total = Amount {
- unit: params.unit,
- decimals: WEI_DECIMALS,
- value: (&amount.value).add(&fee.value),
- };
- let percentage = calculate_percentage(&fee.value, &amount.value);
- transaction::verify_total_fee_maybe_warn(hal, &total.format(), &fee.format(), percentage)
- .await?;
+ verify_standard_total_fee(hal, request, params, &amount.value).await?;
Ok(())
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.