AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 39 Bitcoin

feat(ethereum): Add Merkl claim support.

Public commit record

What the developer wrote

Authored by PrisionMike

57/100 · Thin
feat(ethereum): Add Merkl claim support.

[no changelog]
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit adds support for displaying human-readable confirmation screens when users claim rewards through the Merkl/claim.xyz rewards distributor on Ethereum. It replaces a placeholder that previously forced blind signing for these transactions. The change lets the Trezor show the token and amount being claimed instead of just raw transaction data, but only for a specific known distributor address and only when the claim is for the signer themselves.

Recommended action

Review the clear-signing parser's handling of the omitted `bytes32[][] proofs` array to ensure the top-level length check cannot be bypassed by malformed ABI offsets or lengths. Verify that the hardcoded distributor address and chain restrictions are correct and that the fallback-to-blind-signing behavior is acceptable for user security. Consider whether the 4-token definition cap could lead to inconsistent UI behavior for larger claims.

Security signals we found

01

New clear-signing path for Merkl reward claims

02

Hardcoded allowlist to a single distributor contract address

03

Manual, partial validation of the nested `bytes32[][] proofs` parameter

04

Fallback to blind signing when safety constraints are not met

05

Cap on token-definition fetching (<=4 tokens) to limit resource use

06

Non-zero ETH value rejected for claim transactions

07

User-address uniformity and signer-match enforced before UI confirmation

Risk score

Why this scored 39/100

Our methodology →
Potential impact 8/30
Exploitability 7/25
Stealth signal 6/15
Affected reach 9/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.