Skip to content
This repository was archived by the owner on May 28, 2019. It is now read-only.

Commit d5fb2a4

Browse files
tsusankajpochyla
authored andcommitted
eth/verify: path is not validated; improve invalid signature handling
Ethereum's verify_function takes an actual address as an argument not a derivation path. So any path validation does not make any sense. Also, if the verify_recover function raises an exception, it gets propogated as a DataError (additional fix for #422).
1 parent 4779063 commit d5fb2a4

File tree

1 file changed

+7
-6
lines changed

1 file changed

+7
-6
lines changed

src/apps/ethereum/verify_message.py

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,22 @@
66
from trezor.messages.Success import Success
77
from trezor.ui.text import Text
88

9-
from .address import validate_full_path
10-
11-
from apps.common import paths
129
from apps.common.confirm import require_confirm
1310
from apps.common.layout import split_address
1411
from apps.common.signverify import split_message
1512
from apps.ethereum.sign_message import message_digest
1613

1714

1815
async def verify_message(ctx, msg):
19-
await paths.validate_path(ctx, validate_full_path, path=msg.address)
20-
2116
digest = message_digest(msg.message)
17+
if len(msg.signature) != 65:
18+
raise wire.DataError("Invalid signature")
2219
sig = bytearray([msg.signature[64]]) + msg.signature[:64]
23-
pubkey = secp256k1.verify_recover(sig, digest)
20+
21+
try:
22+
pubkey = secp256k1.verify_recover(sig, digest)
23+
except ValueError:
24+
raise wire.DataError("Invalid signature")
2425

2526
if not pubkey:
2627
raise wire.DataError("Invalid signature")

0 commit comments

Comments
 (0)