fix(solana): show threshold on multisig init
What the developer wrote
Authored by Jakub Janků
fix(solana): show threshold on multisig init
The current flow makes it appear as if the signature scheme is an
N-out-of-N multisig (i.e., all signers are required), when in fact
the scheme is an M-out-of-N threshold scheme. This can give the user
a false sense of security, in particular when M=1 and anyone from
the list of signers can approve token-related operations. This commit
displays the value M to the user.
[no changelog]
(cherry picked from commit 1e5c4edbd7e9073f271f0cdf1bf744cbe0f82c9b)
What changed, and why it matters
This commit fixes a misleading display on Trezor hardware wallets when a user initializes a Solana multisig account. Previously, the device only showed the list of possible signers without showing how many signatures were actually required to approve transactions. This made a 1-out-of-N multisig look like an N-out-of-N multisig, which could trick a user into thinking funds or token operations were safer than they really were. The patch now displays the threshold number (M) so the user sees, for example, '1 of 3 signers required' rather than just '3 signers'.
Users should update to firmware containing this commit and re-verify any Solana multisig accounts they created or interacted with while running older firmware, especially checking the actual threshold value on-chain. Developers should audit other instruction UIs for similarly hidden threshold or permission parameters.
Security signals we found
UI misrepresentation of authorization threshold
Missing display of critical multisig parameter
Potential false sense of security for low-threshold multisigs
User-deception / social-engineering risk rather than memory-safety or cryptographic bug
Evidence from the diff
The change adds a new UIProperty for the ‘number_of_signers’ parameter, labeled ‘Threshold’, in the Solana SPL Token and Token 2022 ‘Initialize multisig’ instruction definitions. It also renames the existing signer_accounts display from ‘Required signers’ to ‘Signers’. The threshold value is already parsed from the instruction data; previously it was marked as ‘(not shown)’ in the documentation and not rendered on the device screen. The fix is purely a UI/UX disclosure change; no cryptographic or parsing logic is modified.
Changed components
core/src/apps/solana/transaction/instructions.pycommon/defs/solana/programs.jsoncommon/defs/solana/programs.mdSolana SPL Token InitializeMultisig instruction UISolana Token-2022 InitializeMultisig instruction UIInspect captured patch +28 / −8
diff --git a/common/defs/solana/programs.json b/common/defs/solana/programs.json
index e535c9e2..34981ffd 100644
--- a/common/defs/solana/programs.json
+++ b/common/defs/solana/programs.json
@@ -1154,9 +1154,13 @@
"account": "multisig_account",
"display_name": "Initialize multisig"
},
+ {
+ "parameter": "number_of_signers",
+ "display_name": "Threshold"
+ },
{
"account": "signer_accounts",
- "display_name": "Required signers"
+ "display_name": "Signers"
}
]
},
@@ -1802,9 +1806,13 @@
"account": "multisig_account",
"display_name": "Init multisig"
},
+ {
+ "parameter": "number_of_signers",
+ "display_name": "Threshold"
+ },
{
"account": "signer_accounts",
- "display_name": "Required signers"
+ "display_name": "Signers"
}
]
},
diff --git a/common/defs/solana/programs.md b/common/defs/solana/programs.md
index 9829c209..6dc5ab90 100644
--- a/common/defs/solana/programs.md
+++ b/common/defs/solana/programs.md
@@ -307,8 +307,8 @@ _This file is generated by `programs.md.mako` via `make solana_templates`, do no
| Label | Value | Type |
|-------|-------|------|
| Initialize multisig | `multisig_account` | `account` |
-| Required signers | `signer_accounts` | `account` |
-| _(not shown)_ | `number_of_signers` | `u8` |
+| Threshold | `number_of_signers` | `u8` |
+| Signers | `signer_accounts` | `account` |
| _(not shown)_ | `rent_sysvar` | `account` |
### (3) Transfer
@@ -476,8 +476,8 @@ _This file is generated by `programs.md.mako` via `make solana_templates`, do no
| Label | Value | Type |
|-------|-------|------|
| Init multisig | `multisig_account` | `account` |
-| Required signers | `signer_accounts` | `account` |
-| _(not shown)_ | `number_of_signers` | `u8` |
+| Threshold | `number_of_signers` | `u8` |
+| Signers | `signer_accounts` | `account` |
| _(not shown)_ | `rent_sysvar` | `account` |
### (3) Transfer
diff --git a/core/src/apps/solana/transaction/instructions.py b/core/src/apps/solana/transaction/instructions.py
index 64943fa7..9ed13947 100644
--- a/core/src/apps/solana/transaction/instructions.py
+++ b/core/src/apps/solana/transaction/instructions.py
@@ -2507,10 +2507,16 @@ def get_instruction(
"Initialize multisig",
None,
),
+ UIProperty(
+ "number_of_signers",
+ None,
+ "Threshold",
+ None,
+ ),
UIProperty(
None,
"signer_accounts",
- "Required signers",
+ "Signers",
None,
),
),
@@ -3368,10 +3374,16 @@ def get_instruction(
"Init multisig",
None,
),
+ UIProperty(
+ "number_of_signers",
+ None,
+ "Threshold",
+ None,
+ ),
UIProperty(
None,
"signer_accounts",
- "Required signers",
+ "Signers",
None,
),
),
Why this scored 49/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.