Clear Signing

Clear Signing decodes smart contract transactions (more specifically, the calling parameters) and displays them in plain, human-readable language on your Trezor’s trusted display so that you know exactly what you’re signing during transaction approval.

Rather than presenting a raw hexadecimal hash or a generic "Data Present" notice, your Trezor device shows the actual action being requested (for example, "Swap 1,000 USDC for ETH on 1inch") along with the specific tokens, amounts, and destination addresses involved.

Why use Clear Signing?

The problem: blind signing

Hardware wallets are designed to protect private keys, but keeping a private key safe is not the same as helping a user understand what they're about to authorize with it.

When users interact with a decentralized application (dApp), their wallet doesn't ordinarily send a plain instruction like "swap 1,000 USDC for ETH." Rather, it sends calldata, which is a string of hexadecimal data that encodes the smart contract function being called and its parameters.

This creates a split:

• The computer screen (i.e., browser, dApp frontend, or companion app) shows a human-friendly description of the transaction, but this is also the layer that can be compromised by malware, phishing, or a spoofed frontend.
• The hardware wallet screen is isolated from the internet-connected host and can't be tampered with remotely. However, it only shows a hash or the message "Data Present," which gives the user nothing to actually verify.

In effect, the one screen a user should trust isn’t showing anything useful, so verification defaults to the one screen that may be compromised. This gap (approving a transaction that cannot be read or understood, based solely on what an external interface claims) is known as blind signing.

What Clear Signing does

Clear Signing closes the blind-signing gap by having the Trezor device itself decode the raw calldata and render it in plain language directly on its trusted display.

Specifically, the device explicitly states:

• The action being requested (Swap, approve etc)
• The tokens involved, shown with the correct tickers and decimal precision (e.g., "1,000 USDC" instead of the raw integer "1000000")
• The destination or counterparty address

Given that the decoding happens on-device against the actual transaction payload, what the dApp frontend claims the transaction does is irrelevant to what is shown on your Trezor’s trusted display. If a compromised frontend swaps in a malicious transaction, your Trezor will still show the real one, and whenever you don’t recognize the expected transactions details, simply don't sign it.

How Clear Signing works

ERC-7730 descriptors

Clear Signing is built on ERC-7730, an open Ethereum standard for describing how a smart contract's transactions should be presented to a human. An ERC-7730 descriptor tells a wallet how to interpret a given contract's function calls (what to call each function, how to label its parameters, and how to format token amounts) without requiring a custom, one-off integration for every application.

The contract registry

Coverage under Clear Signing is registry-based, not universal. A smart contract must have a published ERC-7730 descriptor in the registry before Trezor can decode and label its transactions. If a contract isn't in the registry, transactions against it fall back to standard blind signing (hash / "Data Present"), accompanied by the usual warning.

This means Clear Signing coverage will expand over time as more protocols publish descriptors.

Where clear signing works

• Chains covered: Ethereum mainnet, EVM-compatible Layer 2s (e.g., Arbitrum, Optimism, Base, Polygon), and EVM-compatible sidechains.
• Connection paths: Clear Signing decodes and displays transactions identically regardless of entry point — through Trezor Suite, through WalletConnect (used by dApps connecting to a Trezor), and through Trezor Connect (used by third-party wallet applications). There is no difference in security or presentation between these paths.
• Devices & firmware: Trezor Model T, Safe 3, Safe 5 and Safe 7 hardware wallets running Universal firmware version 2.12.4 and later

Open-source stack

The entire Clear Signing pipeline (ERC-7730 parsing, ABI decoding logic, and the display rendering that puts the result on the trusted screen) is part of Trezor's open-source firmware. This is a deliberate design choice: the guarantee that "what you see is what you sign" only holds if the code doing the decoding can be independently inspected and audited rather than taken on trust.

Implementation in Trezor

Clear Signing is being rolled out as a phased release across the smart contracts with published ERC-7730 descriptors. At launch, supported providers include (among others): 1inch, Aave, Benqi, Corestake, Ethena, Hyperliquid, Lido, LiFi, Lombard, OpenCover, YieldXYZ. Kiln and P2P are supported excluding ETH vaults.

Not every transaction is clear signed. If a contract isn't in the registry, your Trezor shows the usual hash and warning instead. You may see both in the same session, which is normal.

Clear Signing addresses a structural gap in hardware wallet security: protecting a private key is not the same as protecting the decision to use it. By decoding smart contract calldata and displaying the real action, tokens, amounts, and destination on a screen that cannot be tampered with remotely, Trezor removes the need to trust an external interface when confirming a transaction. Coverage depends on ERC-7730 registry adoption and will expand as more protocols publish descriptors; until a given contract is listed, its transactions will continue to require blind signing.

• 
• 

Trezor Safe 7

  

• 
• 
• 

Trezor Safe 5

  

• 
• 
• 
• 

Trezor Safe 3