fix: Hidden native value in EIP-7002/EIP-7251 staking plugin review
Both staking plugins set uiType=ETH_UI_TYPE_GENERIC, which suppresses the standard Amount/To pair. The review then displayed only the withdrawal-request amount or validator pubkeys parsed from calldata, never the native tx.value carried by the transaction. A malicious dApp could attach an arbitrary ETH/native amount to a staking-style request and have the user authorize it without seeing the value on screen. Add a "Tx value" review screen to both EIP-7002 and EIP-7251 plugins whenever the transaction's native value is non-zero, and adjust the screen index ? screen kind mapping so the existing validator/amount screens remain in their expected order. (cherry picked from commit b1d360a8e2d93963bf315db43846e56236880b71)
C
Charles-Edouard de la Vergne committed
1a614a667589b263289e3a1da2570a285c983a8c
Parent: d12a1c9
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr>
on 8/25/2026, 3:03:55 PM