Zurück zum Sicherheitsportal

ERC-20 clear signing hides non-zero ETH value on Trezor firmware

Gemeldet auf May 25, 2026

When clear signing an ERC-20 token approval or transfer, the device displayed the token operation but not any native ETH sent alongside it in the same transaction. A malicious host could therefore attach an arbitrary ETH transfer to what appeared on screen to be a routine token approval, and the user would confirm both while seeing only one. The device now displays the native ETH amount alongside the token operation whenever it is non-zero.

Gemeldet durch Damir