report: 10 fixes to the 7.15 PDF test report — release-gate coverage gaps

Audit of fork develop CI run 28679110349 (PR #284 clearsign v2 static-
schema, 526 junit tests) against the who/what/why standard for every
major daily-driver EVM tx format. Ten fixes:

1. Lower 8 stale requires_firmware("7.15.1") gates to 7.15.0 (signing
   guards x5, blind_sign_blocked/allowed, bip39-word-reject) — the
   behaviors ship in the 7.15.0 line under test; the gate zeroed out
   the EIP-1559 wrong-signer regression suite and the blind-sign
   policy negative path on every 7.15.0 CI run.
2. Document the ETH-section amount-unit rule (Wei below 1 gwei, scaled
   ETH/ticker above) so toy conformance-vector screenshots aren't
   misread as a "never wei" violation.
3. Disclose EIP-712 typed-data hash-signing as a known gap (E16): the
   device signs two host-computed hashes with zero readable domain/
   message display — a daily-driver format with no who/what/why today.
4. Fix the ERC-4337 handleOps flow's overclaiming "innerCall: decoded
   separately, not raw" placeholder — the representative UserOp's
   inner callData is actually empty; the claim is now honest about
   what this flow does and does not prove (regenerated its frozen
   reference-blob snapshot to match).
5. Add 2 new on-device tests for the v2 static-schema headline security
   property, previously unit-tested but never proven on real device
   behavior: calldata/schema length-mismatch falls back to the
   blind-sign gate (VS6), and an unsupported dynamic arg format is
   independently rejected as MALFORMED by the device parser (VS7).
6. Surface the 3 silently-skipped Uniswap V2 liquidity tests (E17-E19)
   with their documented emulator-limitation reason instead of leaving
   them absent from SECTIONS entirely.
7. Surface the 3 passing-but-invisible THORChain-router EVM deposit
   tests (E20-E22), including the router-pin blind-sign-gate proof
   that closed a CRITICAL bypass.
8. Surface 6 passing-but-invisible malformed-blob rejection tests
   (V7a-V7f: empty/truncated/trailing-bytes/wrong-version/zero-sig/
   empty-slot) — the WHY = fail-closed story had no rejection-path
   evidence in the release-gate document.
9. Fix the stale "7.15.1 NEW FEATURES" banner comment and the V8
   context text that claimed "covered in 7.15.0+" while pointing at a
   test gated to 7.15.1 (a self-contradiction in the PDF's own prose,
   resolved by fix #1).
10. Fix print_clearsign_flows() (--flows external-signer reference
    dump): KeyError on flow['shows'] (no catalog flow has that key —
    regression from the move to the shared catalog module) and a
    missing required key_id arg to flow_blob().

Verified: all 6 edited files compile; SECTIONS loaded in the real
firmware-checkout env (245 unique entries, 224->245, zero ID
collisions); every new/changed (module, method) SECTIONS reference
resolves to a real test function; all 51 REFERENCE_BLOB_SNAPSHOTS
still match (only the ERC-4337 entry's hash/length changed, matching
the ARG_FORMAT_STRING value edit in fix #4).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: BitHighlander

keepkeylib/clearsign_catalog.py

@@ -954,10 +954,14 @@ def _bytes_tail(b):
         [{'name': 'sender', 'format': ARG_FORMAT_ADDRESS, 'value': addr('0x9406Cc6185a346906296840746125a0E44976454')},
          {'name': 'nonce', 'format': ARG_FORMAT_STRING, 'value': b'UserOperation nonce: 12'},
          {'name': 'beneficiary', 'format': ARG_FORMAT_ADDRESS, 'value': addr('0x' + '43' * 20)},
-         {'name': 'innerCall', 'format': ARG_FORMAT_STRING, 'value': b'decoded separately, not raw'}],
+         {'name': 'innerCall', 'format': ARG_FORMAT_STRING, 'value': b'empty in this representative UserOp'}],
         why='A bundler-submitted meta-tx: the EntryPoint singleton validates and executes a batch of '
-            'smart-account operations; the inner callData (what the smart account will actually do) '
-            'must be decoded and shown, never left as an opaque blob one layer inside another.',
+            'smart-account operations. KNOWN GAP, disclosed: this representative UserOp carries an '
+            'EMPTY inner callData (the array-of-dynamic-tuples nesting is beyond the current static '
+            'ABI encoder), so this flow proves sender/nonce/beneficiary are decoded but does NOT '
+            'prove the inner callData — what the smart account will actually do — is decoded. A real '
+            'UserOp with non-empty callData would need it decoded and shown, never left as an opaque '
+            'blob one layer inside another; that inner-decode capability is future work.',
         source='https://etherscan.io/address/0x0000000071727De22E5E9d8BAf0edAc6f37da032 (EntryPoint v0.7)',
     ),
 )

scripts/generate-test-report.py

@@ -727,8 +727,12 @@ def _arg_shown(a):
 
     ('E', 'Ethereum', '7.0.0',
      'Ethereum covers native ETH transfers, ERC-20 tokens, EIP-1559 gas, personal message signing '
-     '(EIP-191), and contract interactions. The device displays checksummed addresses (EIP-55), '
-     'values in ETH with 18-decimal precision, and gas parameters.',
+     '(EIP-191), and contract interactions. The device displays checksummed addresses (EIP-55) and '
+     'gas parameters. Amount UNIT rule: values below 1 gwei (1e9 wei) show as raw "Wei" (there is '
+     'no smaller human unit to scale to); values at or above 1 gwei show 18-decimal-scaled ETH (or '
+     'the chain-native ticker on other EVM chains). Some tests below use small conformance-vector '
+     'amounts (e.g. 10 wei) for deterministic-signature pinning — their OLED frames legitimately '
+     'show raw "Wei", not a display bug.',
      [
          'ETH TRANSFER: Show "Send X ETH to 0x..." -> show gas -> confirm -> sign with secp256k1',
          'ERC-20: Decode transfer(to,amount) from contract data -> show token name + amount',
@@ -791,6 +795,48 @@ def _arg_shown(a):
           '0x swap ETH to ERC-20', 'DEX aggregator swap via 0x protocol.', []),
          ('E15', 'test_msg_ethereum_cfunc', 'test_sign_execTx',
           'Contract function call', 'Generic contract call signing.', []),
+         ('E16', 'test_sign_typed_data', 'test_ethereum_sign_typed_data_hash',
+          'EIP-712 typed-data hash signing (legacy, no on-device display)',
+          'KNOWN GAP, disclosed rather than hidden: EIP-712 (the standard behind wallet permits, '
+          'OpenSea listings, and DAO votes — a daily-driver format) is only supported at the '
+          'domain-separator-hash + message-hash level. The device signs two host-computed 32-byte '
+          'hashes; it does NOT parse or display the typed-data domain or message fields, so this '
+          'path shows the user no readable WHO/WHAT — it is effectively a blind hash-sign, not a '
+          'clear-sign. Full structured EIP-712 display is a firmware feature, not yet built.',
+          []),
+         ('E17', 'test_msg_ethereum_erc20_uniswap_liquidity', 'test_sign_uni_approve_liquidity_ETH',
+          'Uniswap V2 add-liquidity approve (pending)',
+          'PENDING, disclosed: known emulator limitation — an approve to an unknown (non-registry) '
+          'token contract cannot complete against the kkemu emulator (matches the sibling '
+          'add/remove-liquidity skips below); the device-firmware path is not in question, only '
+          'CI emulator coverage. Real-device testing is unaffected.',
+          []),
+         ('E18', 'test_msg_ethereum_erc20_uniswap_liquidity', 'test_sign_uni_add_liquidity_ETH',
+          'Uniswap V2 add liquidity ETH+token (pending)',
+          'PENDING, disclosed: same emulator limitation as E17 — a daily-driver LP-deposit flow '
+          'with no PDF proof on this build; tracked for real-device verification.',
+          []),
+         ('E19', 'test_msg_ethereum_erc20_uniswap_liquidity', 'test_sign_uni_remove_liquidity_ETH',
+          'Uniswap V2 remove liquidity ETH+token (pending)',
+          'PENDING, disclosed: same emulator limitation as E17.',
+          []),
+         ('E20', 'test_msg_ethereum_thorchain_deposit', 'test_deposit_legacy_selector',
+          'THORChain router deposit() (legacy selector)',
+          'Cross-chain swap via the THORChain router contract — a daily-driver EVM<->THORChain '
+          'swap path, natively decoded (asset/amount/memo) without clear-sign metadata.',
+          []),
+         ('E21', 'test_msg_ethereum_thorchain_deposit', 'test_deposit_with_expiry_selector',
+          'THORChain router depositWithExpiry()',
+          'Newer router selector variant with an expiry field; same native decode path.',
+          []),
+         ('E22', 'test_msg_ethereum_thorchain_deposit',
+          'test_deposit_with_expiry_non_thor_address_blind_sign_blocked',
+          'THORChain router call to a non-pinned address is blind-sign gated',
+          'WHY it can be trusted: the router CONTRACT ADDRESS is pinned; a call shaped like a '
+          'THORChain deposit but sent to an unpinned address is refused native decoding and falls '
+          'through to the ordinary blind-sign gate instead of being silently native-decoded — the '
+          'fix for the router-spoofing / blind-sign-bypass class of attack.',
+          ['Blind sign disabled (Blocked)']),
      ]),
 
     ('R', 'Ripple (XRP)', '7.0.0',
@@ -920,7 +966,7 @@ def _arg_shown(a):
        'cause fund loss or invalid transactions on the block-lattice.',
        [])]),
 
-    # ===== 7.15.1 NEW FEATURES =====
+    # ===== 7.15.0 NEW FEATURES =====
     ('V', 'EVM Clear-Signing', '7.15.0',
      'The purpose of clear-signing: instead of blind-signing an opaque hash, the device screen '
      'answers WHO / WHAT / WHY before the user approves. WHO = the validated contract address '
@@ -963,6 +1009,24 @@ def _arg_shown(a):
           'Signature verification math', 'Unit test for the metadata blob signature algorithm.', []),
          ('V7', 'test_msg_ethereum_clear_signing', 'test_tampered_blob_fails_verification',
           'Tampered blob fails', 'Any byte change in the blob invalidates the signature.', []),
+         ('V7a', 'test_msg_ethereum_clear_signing', 'test_empty_payload_returns_malformed',
+          'Empty metadata payload rejected', 'A zero-length blob classifies MALFORMED, never VERIFIED.', []),
+         ('V7b', 'test_msg_ethereum_clear_signing', 'test_truncated_payload_returns_malformed',
+          'Truncated metadata payload rejected',
+          'A blob cut short of the minimum structural size classifies MALFORMED.', []),
+         ('V7c', 'test_msg_ethereum_clear_signing', 'test_extra_trailing_bytes_returns_malformed',
+          'Trailing garbage bytes rejected',
+          'A blob with extra bytes appended past its declared structure classifies MALFORMED — '
+          'the parser cannot be tricked by appended data.', []),
+         ('V7d', 'test_msg_ethereum_clear_signing', 'test_wrong_version_returns_malformed',
+          'Unknown version byte rejected', 'A blob with a version byte the firmware does not '
+          'recognize classifies MALFORMED rather than being guessed-parsed.', []),
+         ('V7e', 'test_msg_ethereum_clear_signing', 'test_zero_signature_returns_malformed',
+          'All-zero signature rejected', 'A blob with a zeroed signature field classifies '
+          'MALFORMED — an attacker cannot skip signing by leaving the field blank.', []),
+         ('V7f', 'test_msg_ethereum_clear_signing', 'test_empty_key_slot_returns_malformed',
+          'Metadata against an empty key slot rejected',
+          'A blob referencing a signer slot with no key loaded classifies MALFORMED.', []),
          ('V8', 'test_msg_ethereum_signtx', 'test_ethereum_blind_sign_allowed',
           'Blind sign permitted (AdvancedMode ON)',
           'Contract data with AdvancedMode enabled. Device allows signing. '
@@ -1014,6 +1078,37 @@ def _arg_shown(a):
           'Empty, oversized, control-char and format-specifier aliases are rejected — the alias '
           'is rendered on the warning screen, so it cannot carry a display-spoofing payload.',
           []),
+
+         # ── ethereum signing-path guards (the blind-sign policy negative
+         # half + the EIP-1559 type/fee/chain_id regression suite) ──
+         ('VG1', 'test_msg_ethereum_signtx', 'test_ethereum_blind_sign_blocked',
+          'Blind sign refused (AdvancedMode OFF)',
+          'Unknown contract data with AdvancedMode disabled is hard-rejected before any confirm '
+          'screen — the negative half of the V8 policy pair.',
+          ['Blind signing disabled (Failure)']),
+         ('VG2', 'test_msg_ethereum_signing_guards', 'test_eip1559_requires_chain_id',
+          'EIP-1559 requires chain_id',
+          'A type-2 tx with no chain_id would hash a garbage pre-image and recover the wrong '
+          'signer; the device rejects it outright instead of signing an unbroadcastable tx.',
+          []),
+         ('VG3', 'test_msg_ethereum_signing_guards', 'test_eip1559_no_priority_fee_signs',
+          'EIP-1559 zero priority fee signs correctly',
+          'Regression test for the non-canonical-RLP wrong-signer bug: a type-2 tx with zero/'
+          'absent priority fee must still hash and sign to the correct device address.',
+          []),
+         ('VG4', 'test_msg_ethereum_signing_guards', 'test_type2_without_max_fee_rejected',
+          'Type-2 tx without max_fee_per_gas rejected', '', []),
+         ('VG5', 'test_msg_ethereum_signing_guards', 'test_legacy_with_max_fee_rejected',
+          'Legacy tx with max_fee_per_gas rejected',
+          'Mixing legacy gas_price semantics with EIP-1559 fee fields is refused rather than '
+          'silently mis-hashed.',
+          []),
+         ('VG6', 'test_msg_ethereum_signing_guards',
+          'test_contract_handler_streamed_calldata_signs_full_data',
+          'Streamed calldata signs the full payload',
+          'A contract-clear-sign handler must not confirm only the first chunk while signing '
+          'unshown streamed bytes after it.',
+          []),
      ] + _V_CATALOG_TESTS + [
          ('V%d' % (17 + len(_V_CATALOG_TESTS)),
           'test_msg_ethereum_clear_signing', 'test_clearsign_batch_all_payloads',
@@ -1073,6 +1168,21 @@ def _arg_shown(a):
           'with no tx_hash. The offline format tests above pin the wire format '
           'the device decodes.',
           ['Clearsign warning', 'v2 decoded transfer to/amount', 'Sign transaction']),
+         ('VS6', 'test_msg_ethereum_clear_signing',
+          'test_v2_calldata_length_mismatch_falls_back_to_blind_sign_gate',
+          'v2 decode-mismatch falls back to blind-sign (fail-closed)',
+          'THE headline v2 security property: schema says 2 words, calldata carries 3. '
+          'decode_v2_args\' structural completeness check fails, so the device does NOT '
+          'clear-sign a decode that would not match what it is about to sign — it falls '
+          'through to the ordinary blind-sign gate, and AdvancedMode OFF hard-rejects it.',
+          ['Blind signing disabled (Failure)']),
+         ('VS7', 'test_msg_ethereum_clear_signing',
+          'test_v2_unsupported_arg_format_returns_malformed',
+          'v2 unsupported arg format rejected at blob load',
+          'A hand-crafted v2 blob using an unsupported dynamic format (STRING) — the kind the '
+          'Python serializer itself refuses to build — is independently rejected by the '
+          'device\'s own parser as MALFORMED, before any calldata is even considered.',
+          []),
      ]),
 
     ('G', 'Hive', '7.15.0',

tests/test_msg_ethereum_clear_signing.py

@@ -643,7 +643,7 @@ def test_keccak256_known_vectors(self):
     'permit2-permit-transfer-from': ('c0fde596537a6bf1e53b98d3746638b4249a7a90d8196fe4a9f40f711729ec84', 276),
     'across-spokepool-depositv3': ('ab185113f0b47ef5f6e1fab6a6839df8b71bf8d48796afee64a61ba8b336ac01', 311),
     'safe-exectransaction': ('00a523f8e02d196db7213813edfbeee2a707679b026c6c6b6f8af88d35bf4889', 274),
-    'erc4337-entrypoint-v0.7-handleops': ('0b44fc0f98727877a1d6bd1346300d9fe4b537e48d901002ea241d01b79c52cd', 281),
+    'erc4337-entrypoint-v0.7-handleops': ('29ac50a7c18a4e145d058c75dc9cb6232e875af79006766be0baf5cb674ba04f', 289),
     'eip7702-setcode-authorization': ('0518442c7172b8c57fcbd09ded11b54e1d20076c4b5e79a7490c4ae9c2096a18', 299),
 }
 
@@ -1274,6 +1274,66 @@ def test_v2_transfer_decodes_signs_and_recovers(self):
         signer = recover_eth_signer(sig_r, sig_s, sig_v, tx_hash, chain_id)
         self.assertEqual(signer, self.client.ethereum_get_address(n))
 
+    def test_v2_calldata_length_mismatch_falls_back_to_blind_sign_gate(self):
+        """The headline v2 security property: a blob's schema says 2 words,
+        but the calldata actually being signed carries 3. decode_v2_args'
+        structural completeness check (total calldata bytes must equal
+        exactly 4 + 32*num_args) fails, matches_tx returns false, and the tx
+        falls through to the ordinary blind-sign path — with AdvancedMode
+        OFF that is a hard reject, never a clear-signed-but-wrong display."""
+        self.client.apply_policy("AdvancedMode", 0)
+        self._drop_setup_screenshots()
+        n = parse_path(DEVICE_PATH)
+        chain_id, nonce, gas_price, gas_limit, value = 1, 3, 20000000000, 250000, 0
+        args = [
+            {'format': ARG_FORMAT_ADDRESS, 'address': VITALIK},
+            {'format': ARG_FORMAT_TOKEN_AMOUNT, 'amount': 1500000},
+        ]
+        # calldata carries one EXTRA 32-byte word beyond the 2-arg schema.
+        data = schema_calldata(ERC20_TRANSFER_SELECTOR, args) + (b'\x00' * 32)
+        _, blob = _v2_transfer_blob()
+
+        resp = self.client.ethereum_send_tx_metadata(
+            signed_payload=blob, metadata_version=1, key_id=TEST_KEY_ID)
+        self.assertEqual(resp.classification, CLASSIFICATION_VERIFIED)
+
+        with self.assertRaises(CallException) as ctx:
+            self.client.ethereum_sign_tx(
+                n=n, nonce=nonce, gas_price=gas_price, gas_limit=gas_limit,
+                to=USDC_ADDRESS, value=value, data=data, chain_id=chain_id)
+        self.assertIn("Blind signing disabled", str(ctx.exception))
+
+    def test_v2_unsupported_arg_format_returns_malformed(self):
+        """v2 supports only fixed single-word ADDRESS/AMOUNT/TOKEN_AMOUNT arg
+        formats (decode_v2_args has no dynamic-type support, by design). The
+        Python serializer refuses to BUILD a STRING-format v2 blob (see the
+        offline test_rejects_dynamic_format), but a malicious or buggy host
+        could still hand-craft the raw bytes — the device's own parser must
+        independently reject an unsupported v2 arg format as MALFORMED at
+        blob-load time, before any calldata is even seen."""
+        self._drop_setup_screenshots()
+        body = bytearray()
+        body.append(METADATA_VERSION_SCHEMA)
+        body.extend((1).to_bytes(4, 'big'))                  # chain_id
+        body.extend(USDC_ADDRESS)
+        body.extend(ERC20_TRANSFER_SELECTOR)
+        name = b'transfer'
+        body.extend(len(name).to_bytes(2, 'big'))
+        body.extend(name)
+        body.append(1)                                        # num_args
+        arg_name = b'label'
+        body.append(len(arg_name))
+        body.extend(arg_name)
+        body.append(ARG_FORMAT_STRING)                         # unsupported in v2
+        body.append(CLASSIFICATION_VERIFIED)
+        body.extend((0).to_bytes(4, 'big'))                    # timestamp
+        body.append(TEST_KEY_ID)
+        blob = sign_metadata(bytes(body))
+
+        resp = self.client.ethereum_send_tx_metadata(
+            signed_payload=blob, metadata_version=1, key_id=TEST_KEY_ID)
+        self.assertEqual(resp.classification, CLASSIFICATION_MALFORMED)
+
 
 # ═══════════════════════════════════════════════════════════════════════
 # Dynamically generate one full-confirm device test per CLEARSIGN_FLOWS
@@ -1320,12 +1380,13 @@ def print_clearsign_flows():
     for flow in CLEARSIGN_FLOWS:
         print()
         print('[%s] %s' % (flow['key'], flow['method']))
-        print('  shows      : %s' % flow['shows'])
+        shows = ', '.join('%s=%r' % (a['name'], a.get('value')) for a in flow['args'])
+        print('  shows      : %s' % shows)
         print('  to         : 0x%s' % flow['to'].hex())
         print('  value      : %d' % flow['value'])
         print('  calldata   : 0x%s' % flow['data'].hex())
         print('  tx_hash    : 0x%s' % flow_tx_hash(flow).hex())
-        print('  blob       : %s' % flow_blob(flow, timestamp=REFERENCE_TIMESTAMP).hex())
+        print('  blob       : %s' % flow_blob(flow, TEST_KEY_ID, timestamp=REFERENCE_TIMESTAMP).hex())
 
 
 def print_test_vectors():

tests/test_msg_ethereum_signing_guards.py

@@ -27,7 +27,7 @@ def test_eip1559_requires_chain_id(self):
         """type=2 with no chain_id: Stage 1 counts chain_id as 1 byte but
         hash_rlp_number(0) hashes nothing -> over-declared list header ->
         wrong/garbage signer. The device must reject rather than sign it."""
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)
@@ -49,7 +49,7 @@ def test_eip1559_no_priority_fee_signs(self):
         absent it must encode as the empty integer (0x80). Stage 1 always
         counts it, so Stage 2 must always hash it -- the device must still
         produce a valid signature (not desync the list header)."""
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
@@ -69,7 +69,7 @@ def test_type2_without_max_fee_rejected(self):
         """Typed prefix (0x02) is chosen from msg.type but the fee fields from
         has_max_fee_per_gas. A type=2 tx carrying only gas_price would sign a
         malformed (legacy-fee-in-1559-envelope) field list -> reject."""
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)
@@ -88,7 +88,7 @@ def test_type2_without_max_fee_rejected(self):
     def test_legacy_with_max_fee_rejected(self):
         """A legacy tx (type omitted) carrying max_fee_per_gas would hash two
         fee fields into a legacy structure -> reject the mismatch."""
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)
@@ -117,7 +117,7 @@ def test_contract_handler_streamed_calldata_signs_full_data(self):
         the screen-level assertion (no 'Sablier' clear-sign summary appears for
         streamed calldata) is verified on-device / on the emulator via
         DebugLink layout."""
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)