What the developer wrote
Authored by Qkin-Keystone
update trc-20 token
What changed, and why it matters
This commit updates the list of recognized TRC-20 tokens on a Keystone hardware wallet and changes how unknown tokens are labeled. It is essentially a configuration/data update, not a code-level security fix. The most notable change is that the USDT contract address was corrected and the decimal precision for several tokens was updated. There is no direct evidence in the commit that this fixes an active vulnerability, but incorrect token metadata could theoretically cause users to misread transaction amounts.
No immediate security action required. Treat as a routine data update. If reviewing for supply-chain or phishing risk, verify the newly added contract addresses and decimal values against official Tron token sources, and consider whether the softened 'TRC20 Token' label reduces user caution when signing transactions involving unverified tokens.
Security signals we found
Token contract address changed for USDT
Per-token decimal precision introduced, replacing a shared DIVIDER constant
Unknown token label softened from 'Unknown-TRC20' to 'TRC20 Token'
Evidence from the diff
The patch modifies rust/apps/tron/src/transaction/wrapped_tron.rs. It expands KNOWN_TOKENS from a single-entry array to a slice containing 11 TRC-20 tokens with corrected names, contract addresses, and decimal dividers. The USDT contract address changed from TR7NHqjeKQxGChmqiAkX65phN6kkXNGA2h to TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t, and the divider changed from a shared DIVIDER constant to per-token values (1e6, 1e8, or 1e18). The fallback label for unknown TRC-20 tokens changed from ‘Unknown-TRC20’ to ‘TRC20 Token’. No logic changes were made to parsing, signing, or validation.
Changed components
rust/apps/tron/src/transaction/wrapped_tron.rsTRC-20 token display/metadata handling in Tron appInspect captured patch +34 / −3
diff --git a/rust/apps/tron/src/transaction/wrapped_tron.rs b/rust/apps/tron/src/transaction/wrapped_tron.rs
index dc00cb7..6cf80e0 100644
--- a/rust/apps/tron/src/transaction/wrapped_tron.rs
+++ b/rust/apps/tron/src/transaction/wrapped_tron.rs
@@ -55,8 +55,39 @@ macro_rules! derivation_account_path {
}};
}
-const KNOWN_TOKENS: [(&str, &str, f64); 1] =
- [("TR7NHqjeKQxGChmqiAkX65phN6kkXNGA2h", "USDT", DIVIDER)];
+const KNOWN_TOKENS: &[(&str, &str, f64)] = &[
+ ("TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t", "USDT", 1_000_000.0), // 6 decimals
+ ("TEkxiTehnzSmSe2XqrBj4w32RUN966rdz8", "USDC", 1_000_000.0), // 6 decimals
+ (
+ "TUpMhErZL2fhh4sVNULAbNKLokS4GjC1F4",
+ "TUSD",
+ 1_000_000_000_000_000_000.0,
+ ), // 18 decimals
+ (
+ "TAFjULxiVgT4qWk6UZwjqwZXTSaGaqnVp4",
+ "BTT",
+ 1_000_000_000_000_000_000.0,
+ ), // 18 decimals
+ (
+ "TCFLL5dx5ZJdKnWuesXxi1VPwjLVmWZZy9",
+ "JST",
+ 1_000_000_000_000_000_000.0,
+ ), // 18 decimals
+ ("TFczxzPhnThNSqr5by8tvxsdCFRRz6cPNq", "NFT", 1_000_000.0), // 6 decimals
+ (
+ "TSSMHYeV2uE9qYH95DqyoCuNCzEL1NvU3S",
+ "SUN",
+ 1_000_000_000_000_000_000.0,
+ ), // 18 decimals
+ ("TYhWwKpw43ENFWBTGpzLHn3882f2au7SMi", "WBTC", 100_000_000.0), // 8 decimals
+ ("TNUC9Qb1rRpS5CbWLmNMxXBjyFoydXjWFR", "WTRX", 1_000_000.0), // 6 decimals
+ ("TLa2f6VPqDgRE67v1736s7bJ8Ray5wYjU7", "WIN", 1_000_000.0), // 6 decimals
+ (
+ "TXDk8mbtRbXeYuMNS83CfKPaYYT8XWv9Hz",
+ "USDD",
+ 1_000_000_000_000_000_000.0,
+ ), // 18 decimals
+];
impl WrappedTron {
pub fn from_raw_transaction(raw_tx: Transaction, path: String) -> Result<Self> {
@@ -131,7 +162,7 @@ impl WrappedTron {
instance.token = token_info.1.to_string();
instance.divider = token_info.2;
} else {
- instance.token = "Unknown-TRC20".to_string();
+ instance.token = "TRC20 Token".to_string();
instance.divider = 10u64.pow(6) as f64;
}
}
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.