chore(ethereum): skip clear signing for large data
What the developer wrote
Authored by Ioan Bizău
chore(ethereum): skip clear signing for large data
[no changelog]
What changed, and why it matters
This commit changes how Trezor handles Ethereum transactions with large amounts of embedded data. Previously, the device always tried to 'clear sign' (show human-readable details on screen) for every transaction. Now, if the transaction data is larger than an internal storage limit, it skips clear signing and falls back to 'blind signing' (showing a generic warning). The change is described as a workaround because the clear-signing parser cannot fetch additional data chunks, and enabling it would remove the ability to fall back to blind signing. This is a defensive/hardening change rather than a fix for an active vulnerability, but it reduces the chance that a large malicious transaction could confuse the parser or the user.
Treat as a hardening or reliability improvement. Review whether blind-signing warnings are sufficiently prominent when this fallback is triggered, and consider whether the MAX_DATA_STORED threshold is documented for users. No urgent patch is indicated by the diff alone.
Security signals we found
Behavioral guard added to skip parser on oversized calldata
Fallback to blind signing explicitly preserved
Comment indicates architectural limitation in clear-signing data fetching
No input validation, memory safety, or cryptographic bug visible in diff
Evidence from the diff
In core/src/apps/ethereum/sign_tx.py, the confirm_tx_data function now checks whether len(initial_data) < data_length before invoking clear_signing.try_parse. If the initial data buffer is smaller than the full transaction data length (meaning the full calldata was not stored locally), the code sets clear_signed = False and proceeds to blind signing. The commit comment explains that clear signing does not support fetching additional data, and adding such support would prevent falling back to blind signing. The change is therefore a guard that avoids invoking the clear-signing parser on incomplete calldata.
Changed components
Trezor firmware Ethereum transaction signing flowcore/src/apps/ethereum/sign_tx.pyclear_signing.try_parse parser invocationInspect captured patch +17 / −11
diff --git a/core/src/apps/ethereum/sign_tx.py b/core/src/apps/ethereum/sign_tx.py
index b3a072bb..e749a598 100644
--- a/core/src/apps/ethereum/sign_tx.py
+++ b/core/src/apps/ethereum/sign_tx.py
@@ -266,18 +266,24 @@ async def confirm_tx_data(
value = int.from_bytes(msg.value, "big")
- try:
- clear_signed = await clear_signing.try_parse(
- initial_data,
- address_bytes,
- msg,
- defs,
- maximum_fee,
- fee_items,
- payment_request_verifier,
- )
- except clear_signing.ClearSigningFailed:
+ if len(initial_data) < data_length:
+ # Don't even attempt to clear sign if we have a calldata larger than `MAX_DATA_STORED`.
+ # this is because clear signing doesn't currently support fetching additional data,
+ # which is because if it did, we would not be able to fall back to blind signing anymore.
clear_signed = False
+ else:
+ try:
+ clear_signed = await clear_signing.try_parse(
+ initial_data,
+ address_bytes,
+ msg,
+ defs,
+ maximum_fee,
+ fee_items,
+ payment_request_verifier,
+ )
+ except clear_signing.ClearSigningFailed:
+ clear_signed = False
recipient_str = (
address_from_bytes(address_bytes, network) if address_bytes else None
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.