AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 44 Bitcoin

feat(tron): core edits to include `call_value` in `TriggerSmartContract`

Public commit record

What the developer wrote

Authored by PrisionMike

62/100 · Adequate
feat(tron): core edits to include `call_value` in `TriggerSmartContract`

[no changelog]
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
The short version

What changed, and why it matters

This commit changes how Trezor hardware wallets handle Tron smart-contract calls that include native TRX tokens. Previously, the device did not display or validate the `call_value` field, which means a user could be tricked into sending TRX along with a contract call without seeing it on the device screen. The patch adds a safety check that rejects oversized values and shows the TRX amount during transaction confirmation. It is a defensive fix rather than an exploit.

Recommended action

Treat as a security-hardening fix. Review whether any other Tron contract types carry native value fields that are similarly unconfirmed, and ensure the new `call_value` display is tested for both known TRC-20 and unknown smart-contract paths.

Security signals we found

01

Missing UI confirmation of native asset transfer in smart-contract call

02

Addition of input validation bound (`call_value > _INT64_MAX`)

03

Display of previously hidden `call_value` in transaction summary

04

Client-side protobuf field propagation enabling the new device behavior

Risk score

Why this scored 44/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 6/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.