fix: enforce Tron address padding in runtime
What the developer wrote
Authored by obrusvit
fix: enforce Tron address padding in runtime
[no changelog]
What changed, and why it matters
This commit changes how Trezor handles Tron cryptocurrency smart-contract payments. Previously, the device used a programming assertion to assume that certain address-padding bytes were zero. Now it checks those bytes at runtime and rejects the transaction if the padding is wrong. The change likely prevents a malformed Tron token-transfer request from being misinterpreted or from causing the device to behave unexpectedly. It is a defensive hardening fix rather than a clear-cut remote exploit patch.
Treat as a low-to-moderate security hardening fix. Review whether the generic fallback path after returning False handles the malformed contract safely, and confirm that no other assert-based assumptions in the Tron app can be triggered by untrusted host input. No urgent user action is required beyond normal firmware updates.
Security signals we found
Replaced assert with runtime validation
Changed crash/abort path to controlled rejection
Address-padding canonicalization check
TRC-20 token transfer argument parsing
No changelog entry supplied
Evidence from the diff
In core/src/apps/tron/sign_tx.py, the code that parses a TRC-20 transfer_from/transfer contract argument was changed from an assert to an explicit runtime check. The 32-byte SC_ARGUMENT_BYTES field must contain a 21-byte TRON address (SC_ARGUMENT_ADDRESS_BYTES) plus leading zero padding. The old assert(all(…)) would abort if the padding was non-zero; the new if-not-all-return-False treats invalid padding as a normal validation failure and returns False, letting the caller fall back to generic contract handling. This removes a crash path and ensures non-canonical address padding cannot influence the parsed recipient address.
Changed components
core/src/apps/tron/sign_tx.pyTron TRC-20 token transfer signing flowInspect captured patch +4 / −2
diff --git a/core/src/apps/tron/sign_tx.py b/core/src/apps/tron/sign_tx.py
index 030c10b8..7e649fdf 100644
--- a/core/src/apps/tron/sign_tx.py
+++ b/core/src/apps/tron/sign_tx.py
@@ -202,10 +202,12 @@ async def process_known_trc20_contract(
return False
address_arg = data_reader.read_memoryview(SC_ARGUMENT_BYTES)
- assert all(
+ if not all(
byte == 0
for byte in address_arg[: SC_ARGUMENT_BYTES - SC_ARGUMENT_ADDRESS_BYTES]
- )
+ ):
+ # invalid address padding in contract data
+ return False
# TRON truncates the mandatory prefix \x41 from addresses in data
recipient = b"\x41" + bytes(
Why this scored 61/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.