Kembali ke portal keamanan
ERC-20 clear signing hides non-zero ETH value on Trezor firmware
Dilaporkan pada May 25, 2026
When clear signing an ERC-20 token approval or transfer, the device displayed the token operation but not any native ETH sent alongside it in the same transaction. A malicious host could therefore attach an arbitrary ETH transfer to what appeared on screen to be a routine token approval, and the user would confirm both while seeing only one. The device now displays the native ETH amount alongside the token operation whenever it is non-zero.
Dilaporkan oleh Damir
Kerentanan yang teratasi
Dilaporkan komunitas. Diselidiki. Diselesaikan. Karena keamanan Anda tidak pernah opsional.
- Trezor T Bootloader firmware update retry could skip header checks29 September 2026
- E-shop referral discount could be applied to eGift card purchases16 September 2026
- Authenticity proofs not bounded to their secure element on TS716 Agustus 2026
- Monero payment ID could be signed without being shown13 Agustus 2026
- Missing bounds check in JPEG image decoding12 Agustus 2026
- Cardano output datum and reference script not shown in simple transactions11 Agustus 2026