fix(legacy): allow cross-sign with ETH mainnet
What the developer wrote
Authored by Roman Zeyde
fix(legacy): allow cross-sign with ETH mainnet
Backport #5622 to legacy:
- Previously only non-standard networks (not SLIP-44 60 or 1) could cross-sign
with Ethereum mainnet. Now any network that isn't Ethereum mainnet can use
Ethereum derivation paths
- This is a workaround enabling access to networks like Hyperliquid that
have conflicting chain IDs and can't claim official SLIP-44 registration.
Also, backport legacy testnets' support from #5970.
What changed, and why it matters
This commit loosens address-path validation for older Trezor (legacy) devices when signing Ethereum-style transactions. Previously, only non-standard networks could use Ethereum's mainnet derivation path; now any network except Ethereum mainnet itself can do so, and Ethereum mainnet additionally accepts testnet-style paths. The stated purpose is to support newer networks like Hyperliquid that cannot get an official coin-type registration. The change is a deliberate feature backport, not a covert bug fix, but it does relax a security-relevant boundary that normally prevents cross-network address reuse.
Treat as a deliberate product change rather than an urgent security patch. Review whether the relaxed cross-signing policy matches intended risk acceptance for legacy devices, and ensure users are informed that the same private key/address may now be used across multiple EVM-compatible networks. No immediate patching is indicated by the commit content.
Security signals we found
Relaxation of derivation-path validation for Ethereum signing
Cross-network address reuse now permitted by design
Backport of prior feature work (#5622, #5970) to legacy firmware
Changelog frames change as user-facing feature, not security fix
No mention of vulnerability, CVE, bug bounty, or researcher attribution
Evidence from the diff
The patch modifies check_ethereum_slip44_unhardened() in legacy/firmware/ethereum.c. The old logic allowed Ethereum/testnet paths (SLIP-44 60 or 1) only for unknown networks, and allowed cross-signing with path 60 only for networks whose own SLIP-44 was neither 60 nor 1. The new logic: (1) for any known network whose SLIP-44 is not 60, accepts either that network’s own path or Ethereum mainnet path 60; (2) for Ethereum mainnet (SLIP-44 60), accepts either 60 or testnet path 1. Test fixtures are updated to stop skipping these cases on the T1 (legacy) model and to add expected UI hashes for Hoodi testnet paths. This is a backport of #5622 and #5970.
Changed components
legacy/firmware/ethereum.ccommon/tests/fixtures/ethereum/sign_tx.jsontests/ui_tests/fixtures.jsonInspect captured patch +11 / −7
diff --git a/common/tests/fixtures/ethereum/sign_tx.json b/common/tests/fixtures/ethereum/sign_tx.json
index 589e1a07..a1d053b3 100644
--- a/common/tests/fixtures/ethereum/sign_tx.json
+++ b/common/tests/fixtures/ethereum/sign_tx.json
@@ -174,8 +174,7 @@
"sig_v": 1120132,
"sig_r": "6f8af79a48a022476b2837d2155f82cf9b93da7464b20a54b16c4d9760f8511a",
"sig_s": "77ebd93a6795947c4e273edd6620d085443c4744feca908b39ddb41ffcc3f150"
- },
- "skip_models": ["t1"]
+ }
},
{
"name": "Hoodi Testnet, mainnet path",
@@ -194,8 +193,7 @@
"sig_v": 1120131,
"sig_r": "7b6895910a73fcd71fbd4451304670fa1477b430552de35c746f140c9c8f5d77",
"sig_s": "7365f33b29cbfbec637982b4e3967c3d70c8aa29d36d67f52109dcd6fc162562"
- },
- "skip_models": ["t1"]
+ }
}
]
}
diff --git a/legacy/firmware/.changelog.d/5134.changed b/legacy/firmware/.changelog.d/5134.changed
new file mode 100644
index 00000000..8f8bc88b
--- /dev/null
+++ b/legacy/firmware/.changelog.d/5134.changed
@@ -0,0 +1 @@
+Allow using Ethereum mainnet addresses on all non-Ethereum networks. This enables access to networks like Hyperliquid that use conflicting chain IDs and cannot obtain official SLIP-44 registration.
diff --git a/legacy/firmware/ethereum.c b/legacy/firmware/ethereum.c
index 57d4d709..865797ac 100644
--- a/legacy/firmware/ethereum.c
+++ b/legacy/firmware/ethereum.c
@@ -1210,11 +1210,12 @@ static bool check_ethereum_slip44_unhardened(
if (is_unknown_network(network)) {
// Allow Ethereum or testnet paths for unknown networks.
return slip44 == 60 || slip44 == 1;
- } else if (network->slip44 != 60 && network->slip44 != 1) {
- // Allow cross-signing with Ethereum unless it's testnet.
+ } else if (network->slip44 != 60) {
+ // Allow cross-signing with Ethereum for all non-mainnet networks.
return (slip44 == network->slip44 || slip44 == 60);
} else {
- return (slip44 == network->slip44);
+ // Allow slip44 = 1 for legacy testnets
+ return (slip44 == network->slip44 || slip44 == 1);
}
}
diff --git a/tests/ui_tests/fixtures.json b/tests/ui_tests/fixtures.json
index 6580f1d4..200c6cb9 100644
--- a/tests/ui_tests/fixtures.json
+++ b/tests/ui_tests/fixtures.json
@@ -498,6 +498,8 @@
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Auxilium]": "7df4e4dcd5fd6f56f8674ce67df9c872279f5683191a5a002d2c4a7929e6d0be",
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-ETC]": "25411ebe2889749dc752a7e6dd9fb9a7dfb9ed2c1842dbf24e43e46962283a3b",
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Ethereum]": "5cad96852f605a022d8b7dd3c1e6aa3c49c43b1d715249bec1bd324d3ea00f18",
+"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Hoodi Testnet, mainnet path]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
+"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Hoodi Testnet, testnet path]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Ledger Live legacy path0]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Ledger Live legacy path1]": "5cad96852f605a022d8b7dd3c1e6aa3c49c43b1d715249bec1bd324d3ea00f18",
"T1B1_en_ethereum-test_signtx.py::test_signtx[False-Palm]": "7df4e4dcd5fd6f56f8674ce67df9c872279f5683191a5a002d2c4a7929e6d0be",
@@ -517,6 +519,8 @@
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Auxilium]": "7df4e4dcd5fd6f56f8674ce67df9c872279f5683191a5a002d2c4a7929e6d0be",
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-ETC]": "25411ebe2889749dc752a7e6dd9fb9a7dfb9ed2c1842dbf24e43e46962283a3b",
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Ethereum]": "5cad96852f605a022d8b7dd3c1e6aa3c49c43b1d715249bec1bd324d3ea00f18",
+"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Hoodi Testnet, mainnet path]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
+"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Hoodi Testnet, testnet path]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Ledger Live legacy path0]": "932413226fc9c7cd2e42a14753c985d858f6cc1123e2cbe45e2523a9330f2626",
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Ledger Live legacy path1]": "5cad96852f605a022d8b7dd3c1e6aa3c49c43b1d715249bec1bd324d3ea00f18",
"T1B1_en_ethereum-test_signtx.py::test_signtx[True-Palm]": "7df4e4dcd5fd6f56f8674ce67df9c872279f5683191a5a002d2c4a7929e6d0be",
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.