fix(stellar): confirm signer weight set by StellarSetOptionsOp
What the developer wrote
Authored by Jakub Janků
fix(stellar): confirm signer weight set by StellarSetOptionsOp
Fixes: https://github.com/satoshilabs/trezor-firmware/issues/312
(cherry picked from commit d1beab9790243949a972d6ddca1b297a6efa9ff7)
What changed, and why it matters
This update fixes how the Trezor hardware wallet displays a Stellar 'Set options' operation when a signer is being added or changed. Previously, the device did not show the signer's 'weight' value on its screen. Because weight controls how powerful a signer is (for example, how many signatures are needed to approve a transaction), a user could unknowingly approve a high-weight signer that gives an attacker more control over the account. The fix now shows the weight during confirmation, so users can spot suspicious changes before signing.
Users who sign Stellar Set options operations should update to firmware containing this commit so they can review signer weight before approving. Developers should audit other Stellar operation confirmation flows for similarly hidden security-relevant fields.
Security signals we found
Missing confirmation of security-critical parameter (signer weight) in a signing operation
Changelog entry explicitly tagged .security
Fixes an issue tracker reference (satoshilabs/trezor-firmware#312)
UI change from confirm_blob to confirm_properties to expose additional data
Signer weight directly affects multi-signature authorization thresholds on Stellar
Evidence from the diff
In core/src/apps/stellar/operations/layout.py, confirm_set_options_op previously used confirm_blob to display only the signer type and key when adding or removing a signer. It branched on op.signer_weight > 0 only to choose the title (‘Add signer’ vs ‘Remove signer’) and did not render the numeric weight. The patch replaces confirm_blob with confirm_properties and adds a second property line showing str(op.signer_weight) when the weight is greater than zero. This is a user-interface/confirmation flow change, not a cryptographic or parsing change. The changelog file is tagged .security, indicating the project treats it as a security-relevant fix.
Changed components
Trezor firmware Stellar appcore/src/apps/stellar/operations/layout.pyconfirm_set_options_op user confirmation flowInspect captured patch +11 / −8
### core/.changelog.d/+stellar_signer_weight.security
@@ -0,0 +1 @@
+Stellar: display signer weight when confirming Set options operation.
### core/src/apps/stellar/operations/layout.py
@@ -288,7 +288,6 @@ async def confirm_payment_op(op: StellarPaymentOp, output_index: int) -> None:
async def confirm_set_options_op(op: StellarSetOptionsOp) -> None:
from trezor.enums import StellarSignerType
- from trezor.ui.layouts import confirm_blob
from .. import helpers
@@ -358,10 +357,6 @@ async def confirm_set_options_op(op: StellarSetOptionsOp) -> None:
if signer_key is None or op.signer_weight is None:
raise DataError("Stellar: invalid signer option data.")
- if op.signer_weight > 0:
- title = TR.stellar__add_signer
- else:
- title = TR.stellar__remove_signer
data: StrOrBytes = ""
if signer_type == StellarSignerType.ACCOUNT:
description = TR.words__account
@@ -375,11 +370,18 @@ async def confirm_set_options_op(op: StellarSetOptionsOp) -> None:
else:
raise ProcessError("Stellar: invalid signer type")
- await confirm_blob(
+ props = [(description, data, True)]
+
+ if op.signer_weight > 0:
+ title = TR.stellar__add_signer
+ props.append((TR.words__weight, str(op.signer_weight), True))
+ else:
+ title = TR.stellar__remove_signer
+
+ await confirm_properties(
"op_signer",
title=title,
- description=description,
- data=data,
+ props=props,
verb=TR.buttons__continue,
)
Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.