What the developer wrote
Authored by Jakub Janků
fix(solana): show account owner to user
When assigning an `owner` to an account, using the `CreateAccount`,
`CreateAccountWithSeed`, or `AllocateWithSeed` instructions, it is
critical to display the value to the user. Usually, the owner is a
well-known Solana program, such as the System program
(11111111111111111111111111111111) or the Stake program
(Stake11111111111111111111111111111111111111). However, an attacker
could set the value to a Solana program that is controlled by them
and later drain money from the account. This is especially problematic
since the two `CreateAccount` instructions immediately send funds to
the new account.
[no changelog]
(cherry picked from commit d3f24b0f6739cdae93074c5a4f60658e15c456e0)
What changed, and why it matters
This update fixes a security gap in how Trezor displays Solana transactions. When creating or allocating a Solana account, the device now shows the 'owner' program that will control the new account. Before this change, a malicious owner could be hidden from the user, allowing an attacker to later seize funds sent to the freshly created account. The fix is purely a user-interface change on the hardware wallet screen, not a change to Solana itself.
Users should install firmware containing this commit and carefully verify the 'Owner' field when signing Solana CreateAccount, CreateAccountWithSeed, or AllocateWithSeed transactions. Developers should review other Solana instructions for similarly hidden security-sensitive parameters.
Security signals we found
Missing security-critical UI field for account ownership
Social-engineering / transaction-tampering vector via malicious owner program
Funds-at-risk because CreateAccount instructions deposit lamports immediately
Patch adds explicit user confirmation for owner pubkey
Evidence from the diff
The commit adds the ‘owner’ pubkey parameter to the on-device UI for three Solana System Program instructions: CreateAccount, CreateAccountWithSeed, and AllocateWithSeed. Previously ‘owner’ was marked as not shown in programs.json/programs.md and omitted from the UIProperty list in instructions.py. Because these instructions can create an account and immediately deposit lamports into it, a transaction crafted with an attacker-controlled owner program could cause the user to fund an account whose ownership they never reviewed. The patch surfaces the owner value so the user can verify it before signing.
Changed components
Trezor firmware Solana appcore/src/apps/solana/transaction/instructions.pycommon/defs/solana/programs.jsoncommon/defs/solana/programs.mdInspect captured patch +33 / −3
diff --git a/common/defs/solana/programs.json b/common/defs/solana/programs.json
index 3d8da356..32711695 100644
--- a/common/defs/solana/programs.json
+++ b/common/defs/solana/programs.json
@@ -36,6 +36,10 @@
"account": "new_account",
"display_name": "Create account"
},
+ {
+ "parameter": "owner",
+ "display_name": "Owner"
+ },
{
"parameter": "lamports",
"display_name": "Deposit"
@@ -149,6 +153,10 @@
"account": "created_account",
"display_name": "Create account"
},
+ {
+ "parameter": "owner",
+ "display_name": "Owner"
+ },
{
"parameter": "lamports",
"display_name": "Deposit"
@@ -350,6 +358,10 @@
{
"parameter": "space",
"display_name": "Data size"
+ },
+ {
+ "parameter": "owner",
+ "display_name": "Owner"
}
]
},
diff --git a/common/defs/solana/programs.md b/common/defs/solana/programs.md
index f8047413..af03481c 100644
--- a/common/defs/solana/programs.md
+++ b/common/defs/solana/programs.md
@@ -9,10 +9,10 @@ _This file is generated by `programs.md.mako` via `make solana_templates`, do no
| Label | Value | Type |
|-------|-------|------|
| Create account | `new_account` | `account` |
+| Owner | `owner` | `pubkey` |
| Deposit | `lamports` | `lamports` |
| From | `funding_account` | `account` |
| _(not shown)_ | `space` | `u64` |
-| _(not shown)_ | `owner` | `pubkey` |
### (1) Assign
@@ -34,12 +34,12 @@ _This file is generated by `programs.md.mako` via `make solana_templates`, do no
| Label | Value | Type |
|-------|-------|------|
| Create account | `created_account` | `account` |
+| Owner | `owner` | `pubkey` |
| Deposit | `lamports` | `lamports` |
| From | `funding_account` | `account` |
| _(not shown)_ | `base` | `pubkey` |
| _(not shown)_ | `seed` | `string` |
| _(not shown)_ | `space` | `u64` |
-| _(not shown)_ | `owner` | `pubkey` |
| _(not shown)_ | `base_account` | `account` |
### (4) Advance Nonce Account
@@ -91,9 +91,9 @@ _This file is generated by `programs.md.mako` via `make solana_templates`, do no
|-------|-------|------|
| Allocate data for account | `allocated_account` | `account` |
| Data size | `space` | `u64` |
+| Owner | `owner` | `pubkey` |
| _(not shown)_ | `base` | `pubkey` |
| _(not shown)_ | `seed` | `string` |
-| _(not shown)_ | `owner` | `pubkey` |
| _(not shown)_ | `base_account` | `account` |
### (10) Assign With Seed
diff --git a/core/src/apps/solana/transaction/instructions.py b/core/src/apps/solana/transaction/instructions.py
index 65f00ba3..24dea7f3 100644
--- a/core/src/apps/solana/transaction/instructions.py
+++ b/core/src/apps/solana/transaction/instructions.py
@@ -934,6 +934,12 @@ def get_instruction(
"Create account",
None,
),
+ UIProperty(
+ "owner",
+ None,
+ "Owner",
+ None,
+ ),
UIProperty(
"lamports",
None,
@@ -1088,6 +1094,12 @@ def get_instruction(
"Create account",
None,
),
+ UIProperty(
+ "owner",
+ None,
+ "Owner",
+ None,
+ ),
UIProperty(
"lamports",
None,
@@ -1365,6 +1377,12 @@ def get_instruction(
"Data size",
None,
),
+ UIProperty(
+ "owner",
+ None,
+ "Owner",
+ None,
+ ),
),
"System Program: Allocate With Seed",
True,
Why this scored 76/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.