SIGN IN SIGN UP

fix: ERC1155 batch-transfer UI omits token IDs and per-ID quantities

The ERC1155 safeBatchTransferFrom (0x2eb2c2d6) review path explicitly
skipped copying token IDs (`// don't copy anything since we won't
display it`) and summed every value into a single context->value. The
device then only rendered "<total> from <count> NFT IDs", which let a
malicious dApp slip a high-value token ID into a batch of innocuous
ones without the user being able to detect it on-screen.

Capture the first ERC1155_BATCH_DISPLAY_MAX (id, value) pairs into the
plugin context, render each pair on its own pair of screens, and add
an explicit "WARNING — Only first N of M IDs shown" screen whenever
the batch is larger than what we can surface. The aggregate Total
Quantity screen is preserved.

(cherry picked from commit 7818c34375b472e4a242e59615c44c54feb90acd)
C
Charles-Edouard de la Vergne committed
d0fa13594372a0ba71e4b45bd9350a5fe68427f2
Parent: 1a614a6
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr> on 8/25/2026, 3:03:55 PM