← Watch feed

Informational 19 Bitcoin Committed Jun 15, 2026 · 13:54 UTC

chore: tweak hardcoded LiFi definitions

Trezor/Trezor firmware

9ad5fa49 View source ↗

Public commit record

What the developer wrote

Authored by Ioan Bizău

57/100 · Thin

chore: tweak hardcoded LiFi definitions

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This is a small maintenance update to Trezor's Ethereum clear-signing definitions for the LiFi cross-chain swap service. It adds alternative contract addresses for LiFi on four blockchains where the service uses a different address than usual, and tweaks a few on-screen labels (for example changing 'Recipient' to 'Receiver' and adjusting capitalization). There is no indication of a security vulnerability being fixed.

Recommended action

No security action required. Treat as routine data update. If desired, verify the four alternative LiFi contract addresses against official LiFi/Ledger registry sources before release.

Security signals we found

No security-relevant keywords in commit title or message

No changelog entry requested by commit message

Changes are limited to hardcoded address registry and UI labels

No validation, parsing, or cryptographic code modified

No references to vulnerabilities, CVEs, or security reports

Technical analysis

Evidence from the diff

The commit updates core/src/apps/ethereum/clear_signing_definitions.py. It introduces LIFI_ALT_DEPLOYMENTS, a list of four (chain_id, contract_address) tuples for zkSync Era, Metis, Linea, and an unnamed chain (167004), and includes these in LIFI_CONTEXT alongside the canonical LiFi diamond address. Several FieldDefinition display labels are also changed for consistency. No code logic for parsing, validation, or cryptographic operations is modified.

Changed components

core/src/apps/ethereum/clear_signing_definitions.pyLiFi clear-signing display definitions

Inspect captured patch +15 / −11

diff --git a/core/src/apps/ethereum/clear_signing_definitions.py b/core/src/apps/ethereum/clear_signing_definitions.py
index a8d9f9d5..619183d8 100644
--- a/core/src/apps/ethereum/clear_signing_definitions.py
+++ b/core/src/apps/ethereum/clear_signing_definitions.py
@@ -615,6 +615,7 @@ ALL_DISPLAY_FORMATS.append(
 
 # https://github.com/LedgerHQ/clear-signing-erc7730-registry/blob/master/registry/lifi/calldata-LIFIDiamond.json
 LIFI_ADDRESS = unhexlify("1231DEB6f5749EF6cE6943a275A1D3E7486F4EaE")
+# Chains where the LiFi diamond is deployed at the canonical LIFI_ADDRESS.
 LIFI_CHAINS = [
     1,
     10,
@@ -628,8 +629,6 @@ LIFI_CHAINS = [
     250,
     252,
     288,
-    324,
-    1088,
     1284,
     1285,
     5000,
@@ -640,16 +639,21 @@ LIFI_CHAINS = [
     42170,
     42220,
     43114,
-    59144,
     81457,
-    167004,
     534352,
     1313161554,
     1666600000,
 ]
+# Chains where the LiFi diamond is deployed at a non-canonical address.
+LIFI_ALT_DEPLOYMENTS = [
+    (324, unhexlify("341e94069f53234fe6dabef707ad424830525715")),  # zkSync Era
+    (1088, unhexlify("24ca98fb6972f5ee05f0db00595c7f68d9fafd68")),  # Metis
+    (59144, unhexlify("de1e598b81620773454588b85d6b5d4eec32573e")),  # Linea
+    (167004, unhexlify("3a9a5dba8fe1c4da98187ce4755701bca182f63b")),
+]
 
 LIFI_CONTEXT = BindingContext(
-    [(chain, LIFI_ADDRESS) for chain in LIFI_CHAINS],
+    [(chain, LIFI_ADDRESS) for chain in LIFI_CHAINS] + LIFI_ALT_DEPLOYMENTS,
 )
 
 LIFI_NATIVE_CURRENCY_ADDRESSES = [
@@ -758,7 +762,7 @@ ALL_DISPLAY_FORMATS.append(
             ),
             FieldDefinition(
                 (3,),  # _receiver
-                "Recipient",
+                "Receiver",
                 AddressNameFormatter,
             ),
         ],
@@ -799,7 +803,7 @@ ALL_DISPLAY_FORMATS.append(
         field_definitions=[
             FieldDefinition(
                 ContainerPath.Value,  # @.value
-                "Amount to Send",
+                "Amount to send",
                 AmountFormatter,
             ),
             FieldDefinition(
@@ -855,7 +859,7 @@ ALL_DISPLAY_FORMATS.append(
             ),
             FieldDefinition(
                 (4,),  # _minAmountOut
-                "Minimum to receive",
+                "Minimum to Receive",
                 TokenAmountFormatter(token_path=(5, 3)),  # _swapData.receivingAssetId
             ),
             FieldDefinition(
@@ -911,7 +915,7 @@ ALL_DISPLAY_FORMATS.append(
             ),
             FieldDefinition(
                 (3,),  # _receiver
-                "Recipient",
+                "Receiver",
                 AddressNameFormatter,
             ),
         ],
@@ -1007,7 +1011,7 @@ ALL_DISPLAY_FORMATS.append(
                     0,
                     4,
                 ),  # _swapData.[0].fromAmount
-                "Amount info",
+                "Amount to Send",
                 TokenAmountFormatter(
                     token_path=(5, 0, 2),  # _swapData.[0].sendingAssetId
                     native_currency_address=LIFI_NATIVE_CURRENCY_ADDRESSES,
@@ -1015,7 +1019,7 @@ ALL_DISPLAY_FORMATS.append(
             ),
             FieldDefinition(
                 (4,),  # _minAmount,
-                "Minimum Amount to receive",
+                "Minimum to Receive",
                 TokenAmountFormatter(
                     token_path=(5, -1, 3),  # # _swapData.[-1].receivingAssetId
                     native_currency_address=LIFI_NATIVE_CURRENCY_ADDRESSES,

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters