What the developer wrote
Authored by soralit
feat: add bsc thorchain contracts
What changed, and why it matters
This commit adds two new BNB Smart Chain (BSC) THORChain router contract definitions to the wallet's built-in list of known smart contracts, and makes a small, safe-looking code change so the swap screen can display the correct network symbol (e.g., BNB) instead of hard-coding 'ETH'. There is no obvious security vulnerability in the diff itself; it appears to be a routine feature addition to support more cross-chain swaps.
No immediate security action required. Verify the two new contract addresses (`0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b`) and their selectors against official THORChain/BSC sources before release, and confirm the `strcpy_s` implementation matches the expected safe variant (some non-standard `strcpy_s` signatures exist).
Security signals we found
New smart contract ABI allowlist entries added for THORChain Router on BSC
Hard-coded 'ETH' network symbol replaced with current network symbol in swap UI
Use of strcpy_s with size derived from strlen(symbol)+1
Evidence from the diff
The patch extends ethereum_abi_map in abi_ethereum.c with two ABI entries for the BSC THORChain Router at 0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b, covering the deposit (1fece7b4) and depositWithExpiry (44bc937b) selectors. In gui_eth_batch_tx_widgets.c, the hard-coded erc20Contract->symbol = 'ETH' is replaced with a dynamically allocated copy of g_currentNetwork.symbol using strcpy_s. This is a minor hardening/correctness improvement for multi-network swap display. No memory safety issue is evident because the allocation size is strlen(symbol) + 1 and strcpy_s is given the same size.
Changed components
src/ui/gui_assets/abi/abi_ethereum.csrc/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.cInspect captured patch +10 / −2
diff --git a/src/ui/gui_assets/abi/abi_ethereum.c b/src/ui/gui_assets/abi/abi_ethereum.c
index a9e46ed..10943f8 100644
--- a/src/ui/gui_assets/abi/abi_ethereum.c
+++ b/src/ui/gui_assets/abi/abi_ethereum.c
@@ -3415,6 +3415,14 @@ const ABIItem_t ethereum_abi_map[] = {
"0xe3985E6b61b814F7Cdb188766562ba71b446B46d_44bc937b",
"{\"name\":\"MAYAChain Router\",\"address\":\"0xe3985E6b61b814F7Cdb188766562ba71b446B46d\",\"metadata\":{\"output\":{\"abi\":[{\"inputs\":[{\"internalType\":\"address payable\",\"name\":\"vault\",\"type\":\"address\"},{\"internalType\":\"address\",\"name\":\"asset\",\"type\":\"address\"},{\"internalType\":\"uint256\",\"name\":\"amount\",\"type\":\"uint256\"},{\"internalType\":\"string\",\"name\":\"memo\",\"type\":\"string\"},{\"internalType\":\"uint256\",\"name\":\"expiration\",\"type\":\"uint256\"}],\"name\":\"depositWithExpiry\",\"outputs\":[],\"stateMutability\":\"payable\",\"type\":\"function\"}]}},\"version\":1,\"checkPoints\":[]}"
},
+ {
+ "0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b_1fece7b4",
+ "{\"name\":\"THORChain Router\",\"address\":\"0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b\",\"metadata\":{\"output\":{\"abi\":[{\"inputs\":[{\"internalType\":\"address payable\",\"name\":\"vault\",\"type\":\"address\"},{\"internalType\":\"address\",\"name\":\"asset\",\"type\":\"address\"},{\"internalType\":\"uint256\",\"name\":\"amount\",\"type\":\"uint256\"},{\"internalType\":\"string\",\"name\":\"memo\",\"type\":\"string\"}],\"name\":\"deposit\",\"outputs\":[],\"stateMutability\":\"payable\",\"type\":\"function\"}]}},\"version\":1,\"checkPoints\":[]}"
+ },
+ {
+ "0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b_44bc937b",
+ "{\"name\":\"THORChain Router\",\"address\":\"0xb30eC53F98ff5947EDe720D32aC2da7e52A5f56b\",\"metadata\":{\"output\":{\"abi\":[{\"inputs\":[{\"internalType\":\"address payable\",\"name\":\"vault\",\"type\":\"address\"},{\"internalType\":\"address\",\"name\":\"asset\",\"type\":\"address\"},{\"internalType\":\"uint256\",\"name\":\"amount\",\"type\":\"uint256\"},{\"internalType\":\"string\",\"name\":\"memo\",\"type\":\"string\"},{\"internalType\":\"uint256\",\"name\":\"expiration\",\"type\":\"uint256\"}],\"name\":\"depositWithExpiry\",\"outputs\":[],\"stateMutability\":\"payable\",\"type\":\"function\"}]}},\"version\":1,\"checkPoints\":[]}"
+ },
{
"0x152b9d0FdC40C096757F570A51E494bd4b943E50_66de3b36",
"{\"name\":\"Avax BridgeToken\",\"address\":\"0x152b9d0FdC40C096757F570A51E494bd4b943E50\",\"metadata\":{\"output\":{\"abi\":[{\"inputs\":[{\"internalType\":\"uint256\",\"name\":\"chainId\",\"type\":\"uint256\"}],\"name\":\"addSupportedChainId\",\"outputs\":[],\"stateMutability\":\"nonpayable\",\"type\":\"function\"}]}},\"version\":1,\"checkPoints\":[]}"
diff --git a/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c b/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
index d395f4c..8a8653f 100644
--- a/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
+++ b/src/ui/gui_widgets/multi/web3/gui_eth_batch_tx_widgets.c
@@ -689,8 +689,8 @@ static void GuiRenderSwapOverview(lv_obj_t *parent)
Erc20Contract_t *erc20Contract = FindErc20Contract(g_swapkitContractData->data->swap_in_asset);
bool is_eth = strcmp(g_swapkitContractData->data->swap_in_asset, "0x0000000000000000000000000000000000000000") == 0;
if (is_eth) {
- erc20Contract = malloc(sizeof(Erc20Contract_t));
- erc20Contract->symbol = "ETH";
+ erc20Contract = malloc(sizeof(Erc20Contract_t));
+ erc20Contract->symbol = strcpy_s(malloc(strlen(g_currentNetwork.symbol) + 1), strlen(g_currentNetwork.symbol) + 1, g_currentNetwork.symbol);
erc20Contract->decimals = 18;
}
if (erc20Contract != NULL) {
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.