Solana MintToChecked and BurnChecked prompts ignore signed decimals

[BitHighlander]

Summary

MintToChecked and BurnChecked include a signed decimals byte, and the parser stores it in pi->extra_u8, but their confirmation screens render the base-unit integer directly as N tokens. The adjacent TransferChecked path correctly uses solana_formatTokenAmount(..., pi->extra_u8).

Example: an instruction encoding amount = 1000000000 and decimals = 9 represents 1 token, but the current device prompt says 1000000000 tokens.

This remains on current alpha; PR #557 adds MintTo mint/recipient identities but still renders the raw amount and does not fix BurnChecked.

Security / signing impact

The prompt does not faithfully represent the signed checked instruction's amount semantics. This can cause users to approve or reject based on a value off by up to the signed decimal exponent and makes the reviewed value inconsistent across otherwise analogous SPL checked instructions.

Code evidence

lib/firmware/solana.c assigns the checked instruction's byte 9 to pi->extra_u8 for MintToChecked/BurnChecked. lib/firmware/fsm_msg_solana.h ignores it in SOL_INSTR_TOKEN_MINT_TO and SOL_INSTR_TOKEN_BURN, while SOL_INSTR_TOKEN_TRANSFER already formats with it.

Acceptance criteria

• Format MintToChecked and BurnChecked with the signed decimals byte, using the same bounded formatter behavior as TransferChecked.
• Keep the unchecked MintTo/Burn encoding distinguishable (no fabricated decimals).
• Add boundary tests for 0, normal, and greater-than-supported decimal values.

[BitHighlander]

PR #591 still does not fully remediate this issue at head d7a9da0. Both MintToChecked and BurnChecked enter the verified branch at data_len >= 9, but their signed decimals byte is at offset 9 and therefore requires 10 bytes. A 9-byte truncated Checked instruction is still VERIFIED and displayed with fabricated decimals=0. The same >= checks also admit trailing instruction bytes, while the parser ignores them.

The unchecked opcodes have no signed decimals at all, yet the shared display always calls solana_formatTokenAmount(..., extra_u8) with zero and labels the raw base-unit integer as tokens.

Required:

• Checked forms: require canonical data_len == 10 and preserve a has_token_decimals state.
• Unchecked forms: require canonical data_len == 9 and display base units, not fabricated token units.
• Add regressions for checked length 9 => opaque, checked length 11 => opaque, unchecked length 9 => verified/base-units, and signed decimals 0/6/18.

PR #587 already implements and tests these exact boundaries. Do not close #560 from the current #591 head.

[BitHighlander]

Resolved on alpha by #587 (merge 893c93d). The final immutable head e4ec531 passed both complete CI workflow runs.