refactor(core/ethereum): import `HashWriter` only for type-checking

Trezor/Trezor firmware

ad23bda4 View source ↗

Public commit record

What the developer wrote

Authored by Roman Zeyde

62/100 · Adequate

refactor(core/ethereum): import `HashWriter` only for type-checking

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This is a minor code cleanup in the Ethereum transaction signing module. It moves an import statement so that a helper class (`HashWriter`) is only imported during type-checking, not at runtime. There is no functional change, no bug fix, and no security relevance.

Recommended action

No action required. This is a non-security refactoring change.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit refactors core/src/apps/ethereum/sign_tx.py to move from trezor.utils import HashWriter under the if TYPE_CHECKING: block. This means HashWriter is no longer imported at runtime and is only available to the type checker. The change is purely structural and does not alter runtime behavior, transaction signing logic, or cryptographic handling.

Changed components

core/src/apps/ethereum/sign_tx.py

Inspect captured patch +1 / −1

diff --git a/core/src/apps/ethereum/sign_tx.py b/core/src/apps/ethereum/sign_tx.py
index befbd7b4..187e1f4d 100644
--- a/core/src/apps/ethereum/sign_tx.py
+++ b/core/src/apps/ethereum/sign_tx.py
@@ -4,7 +4,6 @@ from typing import TYPE_CHECKING
 from trezor import TR
 from trezor.crypto import rlp
 from trezor.messages import EthereumTxRequest
-from trezor.utils import HashWriter
 from trezor.wire import DataError
 
 from .helpers import (
@@ -21,6 +20,7 @@ if TYPE_CHECKING:
 
     from trezor.messages import EthereumSignTx, EthereumTxAck
     from trezor.ui.layouts import StrPropertyType
+    from trezor.utils import HashWriter
 
     from apps.common.keychain import Keychain
     from apps.common.payment_request import PaymentRequestVerifier

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters