test(eth): EIP-1559 + contract clear-sign signing-guard regression tests#25
Merged
Merged
Conversation
…tract gate) Covers the firmware Ethereum signing pre-image / clear-sign correctness guards (firmware PR BitHighlander/keepkey-firmware#255, merged to alpha): - type=2 without chain_id is rejected (chain_id over-declared the RLP header) - type=2 with max_fee but no max_priority_fee still signs (priority is a mandatory 0x80-encoded field; Stage 1 and Stage 2 must agree) - type=2 carrying only gas_price, and legacy carrying max_fee_per_gas, rejected - a contract clear-sign handler selector with calldata streamed beyond the initial chunk signs the full data via the generic path instead of confirming a prefix (screen-level assertion verified on-device/emulator)
…ial chunk) 7.15 contract clear-sign handlers require the entire calldata in the initial chunk (data_total == data_initial_chunk.size); transformERC20 calldata is larger, so it now routes through the blind-sign path, which requires the AdvancedMode policy. Set AdvancedMode and gate the test on 7.15.0. The signed bytes are unchanged, so the asserted signature is unchanged.
…15 workaround) The firmware now clear-signs transformERC20 at any calldata size (pinned 0x proxy, bounded by displayed amounts) instead of forcing the blind-sign path, so restore the original no-AdvancedMode test. Supersedes the interim AdvancedMode workaround.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
tests/test_msg_ethereum_signing_guards.pyfor the firmware Ethereum signing-correctness guards merged to firmwarealpha(BitHighlander/keepkey-firmware#255):test_eip1559_requires_chain_id—type=2with nochain_idis rejected.test_eip1559_no_priority_fee_signs—type=2+max_feewithoutmax_priority_feestill produces a valid signature.test_type2_without_max_fee_rejected/test_legacy_with_max_fee_rejected— typed envelope vs fee-field set must match.test_contract_handler_streamed_calldata_signs_full_data— a clear-sign handler selector with calldata streamed past the initial chunk signs via the generic path instead of confirming the prefix.Base is master (the lineage firmware
alphapins viadeps/python-keepkey @ ae1d39ca), so these reach device CI once the firmware submodule is bumped. Supersedes #23, which was based on the divergedfeat/regression-tests-7.15.0-fixesbranch. Gatedrequires_firmware("7.15.1"); the contract-gate screen property is verified on emulator via DebugLink.