What the developer wrote
Authored by Ioan Bizău
fix: make `total_amount` nullable
[no changelog]
What changed, and why it matters
This commit changes two UI layout functions so that the `total_amount` parameter can accept a null/missing value in addition to a string. It is a small type-signature relaxation with no visible behavior change in the diff. There is no direct evidence in the commit that this fixes an exploitable security vulnerability; it is most likely a defensive fix for a UI crash or type mismatch when a transaction total is not available.
Treat as a minor hardening/UI fix. Review the call sites of `confirm_total()` to ensure `None` is handled safely in the layout rendering code, since the diff only changes the type annotation and does not add null-value handling logic.
Security signals we found
Type signature relaxation to allow null input
No runtime validation or sanitization added in the diff
No changelog entry provided
No CVE, advisory, or security discussion in commit metadata
Evidence from the diff
The patch widens the type annotation of total_amount in confirm_total() from str to str | None in both the delizia and eckhart Trezor UI layout modules. No runtime logic is modified in the diff. The change suggests callers may now legitimately pass None when a total cannot be computed or should be hidden. Without the change, passing None could trigger a type error or layout failure, but the commit itself does not show any exploit path.
Changed components
core/src/trezor/ui/layouts/delizia/__init__.pycore/src/trezor/ui/layouts/eckhart/__init__.pyInspect captured patch +2 / −2
diff --git a/core/src/trezor/ui/layouts/delizia/__init__.py b/core/src/trezor/ui/layouts/delizia/__init__.py
index 6d7e7aff..866dc59a 100644
--- a/core/src/trezor/ui/layouts/delizia/__init__.py
+++ b/core/src/trezor/ui/layouts/delizia/__init__.py
@@ -908,7 +908,7 @@ def confirm_properties(
def confirm_total(
- total_amount: str,
+ total_amount: str | None,
fee_amount: str,
title: str | None = None,
total_label: str | None = None,
diff --git a/core/src/trezor/ui/layouts/eckhart/__init__.py b/core/src/trezor/ui/layouts/eckhart/__init__.py
index c26e07ba..6f5d3cfb 100644
--- a/core/src/trezor/ui/layouts/eckhart/__init__.py
+++ b/core/src/trezor/ui/layouts/eckhart/__init__.py
@@ -919,7 +919,7 @@ def confirm_properties(
def confirm_total(
- total_amount: str,
+ total_amount: str | None,
fee_amount: str,
title: str | None = None,
total_label: str | None = None,
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.