What the developer wrote
Authored by Ioan Bizău
fix(core): Ripple unit formatting
[no changelog]
What changed, and why it matters
This commit changes how Ripple (XRP) amounts are displayed on a Trezor hardware wallet screen. Instead of gluing the number and the 'XRP' label together with a simple string join, it now uses a dedicated helper called format_amount_unit. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a formatting cleanup or consistency improvement.
No security action required. Treat as a normal code-quality or UI-consistency change. If a security claim is later made, verify it against the actual behavior of format_amount_unit and the Ripple confirmation flow.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch in core/src/apps/ripple/layout.py replaces four instances of format_amount(…, DECIMALS) + ’ XRP’ with format_amount_unit(format_amount(…, DECIMALS), ‘XRP’). This is a refactor to use a centralized unit-formatting helper. The diff does not show any change to validation, parsing, arithmetic, or trust-boundary logic. No security-relevant behavior is demonstrated by the code change itself.
Changed components
core/src/apps/ripple/layout.pyInspect captured patch +9 / −5
diff --git a/core/src/apps/ripple/layout.py b/core/src/apps/ripple/layout.py
index 0e82910d6..ccd4db778 100644
--- a/core/src/apps/ripple/layout.py
+++ b/core/src/apps/ripple/layout.py
@@ -2,7 +2,7 @@ from typing import TYPE_CHECKING
from trezor import TR, wire
from trezor.enums import ButtonRequestType
-from trezor.strings import format_amount
+from trezor.strings import format_amount, format_amount_unit
from trezor.ui.layouts import confirm_metadata, confirm_total
from .helpers import DECIMALS
@@ -15,8 +15,8 @@ if TYPE_CHECKING:
async def require_confirm_total(total: int, fee: int) -> None:
await confirm_total(
- format_amount(total, DECIMALS) + " XRP",
- format_amount(fee, DECIMALS) + " XRP",
+ format_amount_unit(format_amount(total, DECIMALS), "XRP"),
+ format_amount_unit(format_amount(fee, DECIMALS), "XRP"),
)
@@ -35,7 +35,9 @@ async def require_confirm_destination_tag(tag: int) -> None:
async def require_confirm_tx(to: str, value: int, chunkify: bool = False) -> None:
from trezor.ui.layouts import confirm_output
- await confirm_output(to, format_amount(value, DECIMALS) + " XRP", chunkify=chunkify)
+ await confirm_output(
+ to, format_amount_unit(format_amount(value, DECIMALS), "XRP"), chunkify=chunkify
+ )
async def require_confirm_payment_request(
@@ -48,7 +50,9 @@ async def require_confirm_payment_request(
from apps.common.paths import address_n_to_str
assert verified_payment_request.amount is not None # required for non-CoinJoin
- total_amount = format_amount(verified_payment_request.amount, DECIMALS) + " XRP"
+ total_amount = format_amount_unit(
+ format_amount(verified_payment_request.amount, DECIMALS), "XRP"
+ )
texts = []
refunds = []
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.