wallet_api: reject transaction file signing with hardware wallets

What changed, and why it matters

This change blocks a specific command—signing unsigned transaction files—from being used when a Monero wallet's private keys live on a hardware device (Ledger/Trezor). Before the patch, the software apparently allowed users to attempt this operation, which hardware wallets do not actually support. The patch now returns a clear error instead of proceeding. The risk is that a user or third-party tool could be misled into thinking a transaction was properly signed when it was not, potentially causing loss of funds or a failed/confused workflow. No exploit code is shown in the commit.

Security signals we found

Evidence from the diff

Changed components

diff --git a/src/wallet/api/unsigned_transaction.cpp b/src/wallet/api/unsigned_transaction.cpp
index 1130159..6555f30 100644
--- a/src/wallet/api/unsigned_transaction.cpp
+++ b/src/wallet/api/unsigned_transaction.cpp
@@ -76,6 +76,12 @@ bool UnsignedTransactionImpl::sign(const std::string &signedFileName)
      m_status = Status_Error;
      return false;
   }
+  if(m_wallet.m_wallet->key_on_device())
+  {
+     m_errorString = tr("Command not supported by hardware wallet");
+     m_status = Status_Error;
+     return false;
+  }
   std::vector<tools::wallet2::pending_tx> ptx;
   try
   {