Summary
A systematic parser-to-prompt comparison after #558/#559 found the same clear-sign identity gap in adjacent instruction families still classified SOL_TX_REVIEW_VERIFIED:
- System transfer omits the funding account; nonce advance/withdraw/init/authorize omit the nonce account; assign/allocate omit the affected account.
- SPL TransferChecked omits its source token account; Revoke omits the affected token account.
- Stake withdraw/authorize omit the stake account.
- Vote authorize/withdraw/update-validator/update-commission omit the vote account.
- Associated-token-account Create displays no payer, ATA address, owner, or mint despite parsing all four.
Many of these parser branches also accept short account lists and then copy_account() silently leaves zero-filled identities, so merely adding a screen without canonical account-count guards can create a fabricated 111... review value. Stake/Vote Authorize additionally copy authority from account index 1, which is the clock sysvar in their canonical layouts; the current authority signer is index 2.
Security impact
A compromised host can substitute the signed account being funded, closed, delegated, reassigned, or authorized while preserving an identical verified device prompt. The device only verifies that its derived key appears somewhere in the required-signer prefix; it does not prove that key is the authority field of each displayed instruction, so source identities cannot safely be inferred from the selected derivation path.
Acceptance criteria
- Display every security-relevant signed source/target identity on a non-truncating screen, or downgrade the instruction to opaque/Advanced Mode.
- Require canonical data lengths and enough account indices before classifying verified; short layouts must fail closed/opaque rather than display zero-filled keys.
- Correct Stake/Vote Authorize current-authority account extraction to canonical index 2.
- Add parser/review regressions for each family and missing-account cases.
- Preserve signer-in-transaction verification.
Found while independently auditing the looping alpha auditor and implementing #558/#559.
Summary
A systematic parser-to-prompt comparison after #558/#559 found the same clear-sign identity gap in adjacent instruction families still classified
SOL_TX_REVIEW_VERIFIED:Many of these parser branches also accept short account lists and then
copy_account()silently leaves zero-filled identities, so merely adding a screen without canonical account-count guards can create a fabricated111...review value. Stake/Vote Authorize additionally copyauthorityfrom account index 1, which is the clock sysvar in their canonical layouts; the current authority signer is index 2.Security impact
A compromised host can substitute the signed account being funded, closed, delegated, reassigned, or authorized while preserving an identical verified device prompt. The device only verifies that its derived key appears somewhere in the required-signer prefix; it does not prove that key is the authority field of each displayed instruction, so source identities cannot safely be inferred from the selected derivation path.
Acceptance criteria
Found while independently auditing the looping alpha auditor and implementing #558/#559.