fix(core/ethereum): fix SLIP-24 payment request for ERC-20 tokens
What the developer wrote
Authored by Roman Zeyde
fix(core/ethereum): fix SLIP-24 payment request for ERC-20 tokens
What changed, and why it matters
This commit fixes a bug in the Trezor hardware wallet's Ethereum transaction signing flow. When using SLIP-24 payment requests with ERC-20 token transfers, the device could incorrectly skip the user-confirmation step for the transaction details. The fix ensures that 'clear signing' mode (which bypasses some confirmations) is checked before the payment-request path, so users still see and approve the token transfer details.
Review the full `confirm_tx_data` function and related payment-request tests to ensure no other token-specific fields are mishandled. Add regression tests for ERC-20 token transfers with SLIP-24 payment requests. Verify that the fix does not suppress legitimate confirmations in non-payment-request clear-signing scenarios.
Security signals we found
User confirmation bypass for ERC-20 token transfers when combined with SLIP-24 payment requests
Control-flow reordering in transaction signing path
Potential mismatch between transaction type and confirmation screen shown to user
Evidence from the diff
In core/src/apps/ethereum/sign_tx.py, the confirm_tx_data coroutine previously checked payment_request_verifier is not None before checking clear_signed. Because a SLIP-24 payment request can be present for an ERC-20 token transfer, the code entered the payment-request branch and then, after verifier checks, called layout.confirm_ethereum_tx with None for the token-related fields, falling through to an elif not clear_signed block that no longer applied. The patch reorders the logic so that clear_signed is evaluated first: if true, it returns immediately; otherwise it proceeds to the payment-request branch or the normal data-confirmation branch. This prevents unintended UI/confirmation behavior for ERC-20 token transactions that include a payment request.
Changed components
core/src/apps/ethereum/sign_tx.pyEthereum transaction signing flowSLIP-24 payment request handlingERC-20 token transfer confirmation UIInspect captured patch +5 / −2
### core/.changelog.d/7140.fixed
@@ -0,0 +1 @@
+Ethereum: Fix SLIP-24 payment request for ERC-20 tokens.
### core/src/apps/ethereum/sign_tx.py
@@ -193,7 +193,9 @@ async def confirm_tx_data(
address_from_bytes(address_bytes, network) if address_bytes else None
)
- if payment_request_verifier is not None:
+ if clear_signed:
+ return
+ elif payment_request_verifier is not None:
if data_length != 0:
raise DataError(
"Data length must be 0 when `payment_request_verifier` is provided."
@@ -219,7 +221,7 @@ async def confirm_tx_data(
None,
None,
)
- elif not clear_signed:
+ else:
if data_length > 0:
# Stream, confirm and hash the rest of the calldata chunks.
await _confirm_data_chunks(Why this scored 38/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.