fix: ERC1155 batch-transfer UI omits token IDs and per-ID quantities
The ERC1155 safeBatchTransferFrom (0x2eb2c2d6) review path explicitly skipped copying token IDs (`// don't copy anything since we won't display it`) and summed every value into a single context->value. The device then only rendered "<total> from <count> NFT IDs", which let a malicious dApp slip a high-value token ID into a batch of innocuous ones without the user being able to detect it on-screen. Capture the first ERC1155_BATCH_DISPLAY_MAX (id, value) pairs into the plugin context, render each pair on its own pair of screens, and add an explicit "WARNING — Only first N of M IDs shown" screen whenever the batch is larger than what we can surface. The aggregate Total Quantity screen is preserved. (cherry picked from commit 7818c34375b472e4a242e59615c44c54feb90acd)
C
Charles-Edouard de la Vergne committed
d0fa13594372a0ba71e4b45bd9350a5fe68427f2
Parent: 1a614a6
Committed by Alexandre Paillier <alexandre.paillier@ledger.fr>
on 8/25/2026, 3:03:55 PM