test: unchecked SPL transfer/approve require AdvancedMode; native ETH deposit uses address(0)

- Solana token transfer/approve/with_metadata now assert the unchecked variants
  are blocked without AdvancedMode and blind-sign with it (no signed mint to
  clear-sign against).
- THORChain deposit fixture uses address(0) for native ETH — the only native
  form the pinned routers accept (0xEeee sentinel would revert on-chain).

Author: BitHighlander

tests/test_msg_ethereum_thorchain_deposit.py

@@ -27,7 +27,7 @@ def _build_deposit_calldata(memo):
     """Build deposit(address,address,uint256,string) calldata (legacy selector)."""
     selector    = bytes.fromhex("1fece7b4")
     vault       = bytes(12) + bytes.fromhex(THOR_ROUTER)
-    asset       = bytes(12) + bytes.fromhex(ETH_NATIVE)
+    asset       = bytes(32)  # address(0): the only native-ETH form the routers accept
     amount      = (500000000000000000).to_bytes(32, "big")     # 0.5 ETH
     memo_offset = (4 * 32).to_bytes(32, "big")                 # offset = 128
     memo_bytes  = memo.encode("ascii")
@@ -41,7 +41,7 @@ def _build_deposit_with_expiry_calldata(memo, expiry=9999999999):
     """Build depositWithExpiry(address,address,uint256,string,uint256) calldata."""
     selector    = bytes.fromhex("44bc937b")
     vault       = bytes(12) + bytes.fromhex(THOR_ROUTER)
-    asset       = bytes(12) + bytes.fromhex(ETH_NATIVE)
+    asset       = bytes(32)  # address(0): the only native-ETH form the routers accept
     amount      = (500000000000000000).to_bytes(32, "big")     # 0.5 ETH
     memo_offset = (5 * 32).to_bytes(32, "big")                 # offset = 160 (after expiry)
     expiry_b    = expiry.to_bytes(32, "big")

tests/test_msg_solana_signtx.py

@@ -263,31 +263,51 @@ def _build_tx(self, from_pubkey, accounts, program_id, instr_data, extra_account
     # ================================================================
 
     def test_solana_sign_token_transfer(self):
-        """SPL Token transfer — OLED shows 'Send [amount] tokens to [address]'."""
+        """Unchecked SPL Transfer has no signed mint (the token being moved is
+        not provable), so it now requires AdvancedMode (blind-sign); only the
+        TransferChecked variant clear-signs."""
         self.requires_fullFeature()
         self.setup_mnemonic_allallall()
+        from keepkeylib.client import CallException
         from_pubkey = self._get_from_pubkey()
         to_account = b'\x33' * 32  # destination token account
-        owner = from_pubkey  # token owner = signer
         # SPL Token Transfer instruction: opcode=3 (u8) + amount (LE u64)
         instr_data = bytes([3]) + struct.pack('<Q', 50000000)  # 50M tokens
         raw_tx = self._build_tx(from_pubkey, [to_account], self.TOKEN_PROGRAM, instr_data)
-        resp = self.client.call(messages.SolanaSignTx(
-            address_n=parse_path("m/44'/501'/0'/0'"), raw_tx=raw_tx))
+        tx = messages.SolanaSignTx(
+            address_n=parse_path("m/44'/501'/0'/0'"), raw_tx=raw_tx)
+
+        self.client.apply_policy('AdvancedMode', False)
+        with self.assertRaises(CallException):
+            self.client.call(tx)
+
+        self.client.apply_policy('AdvancedMode', True)
+        resp = self.client.call(tx)
         self.assertEqual(len(resp.signature), 64)
+        self.client.apply_policy('AdvancedMode', False)
 
     def test_solana_sign_token_approve(self):
-        """SPL Token approve — OLED shows 'Approve [amount] tokens to [delegate]'."""
+        """Unchecked SPL Approve hides the delegated token's mint, so it now
+        requires AdvancedMode (blind-sign)."""
         self.requires_fullFeature()
         self.setup_mnemonic_allallall()
+        from keepkeylib.client import CallException
         from_pubkey = self._get_from_pubkey()
         delegate = b'\x44' * 32
         # SPL Token Approve: opcode=4 (u8) + amount (LE u64)
         instr_data = bytes([4]) + struct.pack('<Q', 100000000)
         raw_tx = self._build_tx(from_pubkey, [delegate], self.TOKEN_PROGRAM, instr_data)
-        resp = self.client.call(messages.SolanaSignTx(
-            address_n=parse_path("m/44'/501'/0'/0'"), raw_tx=raw_tx))
+        tx = messages.SolanaSignTx(
+            address_n=parse_path("m/44'/501'/0'/0'"), raw_tx=raw_tx)
+
+        self.client.apply_policy('AdvancedMode', False)
+        with self.assertRaises(CallException):
+            self.client.call(tx)
+
+        self.client.apply_policy('AdvancedMode', True)
+        resp = self.client.call(tx)
         self.assertEqual(len(resp.signature), 64)
+        self.client.apply_policy('AdvancedMode', False)
 
     def test_solana_sign_stake_delegate(self):
         """Stake delegate — OLED shows 'Delegate stake?'."""
@@ -542,9 +562,12 @@ def test_solana_sign_multi_instruction_transfer_and_memo(self):
     # ================================================================
 
     def test_solana_sign_token_transfer_with_metadata(self):
-        """SPL Token transfer with SolanaTokenInfo for OLED display of symbol + decimals."""
+        """Host SolanaTokenInfo does NOT make an unchecked transfer clear-signable:
+        the mint is not signed, so the metadata is unauthenticated and the tx
+        still requires AdvancedMode. (TransferChecked binds the mint on-chain.)"""
         self.requires_fullFeature()
         self.setup_mnemonic_allallall()
+        from keepkeylib.client import CallException
 
         from_pubkey = self._get_from_pubkey()
         to_account = b'\x33' * 32  # destination token account
@@ -567,13 +590,20 @@ def test_solana_sign_token_transfer_with_metadata(self):
             decimals=6,
         )
 
-        resp = self.client.call(messages.SolanaSignTx(
+        tx = messages.SolanaSignTx(
             address_n=parse_path("m/44'/501'/0'/0'"),
             raw_tx=raw_tx,
             token_info=[token_info],
-        ))
+        )
+        self.client.apply_policy('AdvancedMode', False)
+        with self.assertRaises(CallException):
+            self.client.call(tx)
+
+        self.client.apply_policy('AdvancedMode', True)
+        resp = self.client.call(tx)
         self.assertEqual(len(resp.signature), 64)
         self.assertFalse(all(b == 0 for b in resp.signature))
+        self.client.apply_policy('AdvancedMode', False)
 
     # ================================================================
     # Path edge-case tests