feat(clear_signing): support native currency address in token formatter
What changed, and why it matters
This commit adds support for passing a 'native currency address' into an Ethereum token amount formatter used for Trezor's clear-signing feature. It is a small feature addition with no obvious security bug. There is no evidence in the commit of a vulnerability, exploit, or security fix.
No immediate security action required. Review the `TokenAmountFormatter` implementation to confirm that `native_currency_address` values are handled safely (e.g., validated for expected length and not used in unsafe parsing) before closing the feature.
Security signals we found
No security-relevant keywords in commit title or message
No changelog entry provided
No input validation changes observed
No bounds checking or memory safety changes observed
No references to CVEs, advisories, or security reports
Evidence from the diff
The change extends core/src/apps/ethereum/clear_signing.py so that when constructing a TokenAmountFormatter, if the parsed ERC-7730 metadata includes native_currency_address, those addresses are converted from bytes-like objects into Python bytes and passed as a formatter parameter. This appears to be a feature-completion patch for displaying native currency information during clear signing. No validation, memory-safety, or cryptographic logic is modified.
Changed components
core/src/apps/ethereum/clear_signing.pyTokenAmountFormatter construction pathInspect captured patch +4 / −0
### core/src/apps/ethereum/clear_signing.py
@@ -877,6 +877,10 @@ def decode_path(p: EthereumERC7730Path) -> Path:
formatter_params["threshold"] = int.from_bytes(info.threshold, "big")
if info.threshold_message is not None:
formatter_params["threshold_message"] = info.threshold_message
+ if info.native_currency_address:
+ formatter_params["native_currency_address"] = [
+ bytes(addr) for addr in info.native_currency_address
+ ]
formatter = TokenAmountFormatter(**formatter_params)
elif fmt_type == FT.FORMATTER_UNIT:
formatter_params = {}Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.