AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 35 Bitcoin

feat(core): SLIP-24 payment requests for Stellar

Public commit record

What the developer wrote

Authored by Ioan Bizău

57/100 · Thin
feat(core): SLIP-24 payment requests for Stellar

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit adds support for SLIP-24 payment requests to Stellar transactions on Trezor devices. It lets a merchant or service provider attach a signed payment request to a Stellar transaction, which the device verifies and shows on screen before signing. The change is a feature addition, not a fix for a known vulnerability, and it includes safeguards such as rejecting payment requests that contain multiple operations.

Recommended action

Review the PaymentRequestVerifier implementation and the confirm_payment_request UI layout to ensure the verified amount, recipient, and asset are displayed unambiguously and cannot be confused with ordinary operation screens. Verify that suppressing per-operation confirmation does not allow a malicious host to smuggle unexpected operation types inside a payment-request transaction.

Security signals we found

01

New optional payment request field added to StellarSignTx protobuf

02

Operation confirmations suppressed when payment request is present

03

Payment request verified after serialization but before final user confirmation

04

Multiple operations explicitly rejected in payment-request mode

05

Legacy firmware configured to ignore the new field

06

Keychain decorator changed from auto_keychain to with_slip44_keychain with SLIP-21 namespace for SLIP-24

Risk score

Why this scored 35/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.