fix(clear_signing): skip empty property screen

Trezor/Trezor firmware

c7473b71 View source ↗

Public commit record

What the developer wrote

Authored by PrisionMike

57/100 · Thin

fix(clear_signing): skip empty property screen

[no changelog]

✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit is a minor user-interface fix for Ethereum 'clear signing' flows on Trezor hardware wallets. It simply skips showing a contract-details screen when there are no details to display. There is no indication this is a security fix, and the change does not alter what users must approve before signing a transaction.

Recommended action

No security action required; treat as routine UI polish. If auditing, verify that `confirm_properties()` still displays all provided properties and that downstream signing still requires the final `confirm_summary()` approval.

Security signals we found

UI/UX hardening only

No cryptographic or authorization logic changed

No bypass of required user confirmation for non-empty data

Commit title and message describe a UI fix, not a security issue

Technical analysis

Evidence from the diff

The change wraps an existing confirm_properties() call in if properties: across four UI layout implementations (bolt, caesar, delizia, eckhart). Previously the code unconditionally called confirm_properties() even when the properties list was empty, which likely produced an empty or confusing screen. The patch prevents that empty screen from being shown. It does not change the set of approved data, remove any confirmation step for non-empty properties, or modify cryptographic checks.

Changed components

core/src/trezor/ui/layouts/bolt/__init__.pycore/src/trezor/ui/layouts/caesar/__init__.pycore/src/trezor/ui/layouts/delizia/__init__.pycore/src/trezor/ui/layouts/eckhart/__init__.py

Inspect captured patch +24 / −20

### core/src/trezor/ui/layouts/bolt/__init__.py
@@ -1285,11 +1285,12 @@ async def confirm_ethereum_clear_signing(
 
         await confirm_action("confirm_contract", TR.words__provider, recipient_str)
         await confirm_action("confirm_contract", TR.words__intent, intent)
-        await confirm_properties(
-            "confirm_contract",
-            TR.ethereum__confirm_contract,
-            properties,
-        )
+        if properties:
+            await confirm_properties(
+                "confirm_contract",
+                TR.ethereum__confirm_contract,
+                properties,
+            )
         with trezorui_api.confirm_summary(
             amount=amount,
             amount_label=with_colon(TR.words__amount) if amount is not None else None,

### core/src/trezor/ui/layouts/caesar/__init__.py
@@ -1260,11 +1260,12 @@ async def confirm_ethereum_clear_signing(
 
         await confirm_action("confirm_contract", TR.words__provider, recipient_str)
         await confirm_action("confirm_contract", TR.words__intent, intent)
-        await confirm_properties(
-            "confirm_contract",
-            TR.ethereum__confirm_contract,
-            properties,
-        )
+        if properties:
+            await confirm_properties(
+                "confirm_contract",
+                TR.ethereum__confirm_contract,
+                properties,
+            )
 
         with trezorui_api.confirm_summary(
             amount=amount,

### core/src/trezor/ui/layouts/delizia/__init__.py
@@ -1262,11 +1262,12 @@ async def confirm_ethereum_clear_signing(
     ) -> None:
         await confirm_action("confirm_contract", TR.words__provider, recipient_str)
         await confirm_action("confirm_contract", TR.words__intent, intent)
-        await confirm_properties(
-            "confirm_contract",
-            TR.ethereum__confirm_contract,
-            properties,
-        )
+        if properties:
+            await confirm_properties(
+                "confirm_contract",
+                TR.ethereum__confirm_contract,
+                properties,
+            )
         with trezorui_api.confirm_summary(
             amount=amount,
             amount_label=TR.words__amount if amount is not None else None,

### core/src/trezor/ui/layouts/eckhart/__init__.py
@@ -1315,11 +1315,12 @@ async def confirm_ethereum_clear_signing(
     ) -> None:
         await confirm_action("confirm_contract", TR.words__provider, recipient_str)
         await confirm_action("confirm_contract", TR.words__intent, intent)
-        await confirm_properties(
-            "confirm_contract",
-            TR.ethereum__confirm_contract,
-            properties,
-        )
+        if properties:
+            await confirm_properties(
+                "confirm_contract",
+                TR.ethereum__confirm_contract,
+                properties,
+            )
         with trezorui_api.confirm_summary(
             amount=amount,
             amount_label=TR.words__amount if amount is not None else None,

Risk score

Why this scored 19/100

Our methodology →

Potential impact 2/30

Exploitability 1/25

Stealth signal 1/15

Affected reach 3/15

Confidence 8/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 19/100

Community notes

Related watches

chore(core): improvements to English copy

feat(core): app root packet downgrade protection

fix(core/rust): discard low-order keys in THP handshake