test(hive): phase-3 clear-sign op device tests + wire-symbol fix#198
Merged
BitHighlander merged 2 commits intoJul 21, 2026
Merged
Conversation
Covers the 11 ops added to the firmware clear-sign table: transfer_to_vesting,
withdraw_vesting, limit_order_create/cancel, convert, comment_options,
transfer_to/from_savings, claim_reward_balance, delegate_vesting_shares,
account_update2.
Transactions are built by this file's own Graphene serializer (the _op_*
helpers), never from firmware-emitted bytes, so a parser bug and a serializer
bug cannot cancel out.
Beyond happy-path sign-and-recover, the negative cases pin the invariants that
actually protect the user:
- asset symbol AND precision are pinned per op: a swapped symbol hides a
~2000x value difference behind an identical-looking number, and a wrong
precision moves the decimal point relative to what the chain applies
- negative int64 amounts are refused (they would render as enormous
positive values)
- comment_options only binds immediately after a comment with a matching
author and permlink; detached it could redirect the payout of a post
published earlier that the user is not reviewing on screen
- account_update2 refuses any authority field
- beneficiaries must be strictly ascending, unique, and sum to <= 100%
- zero amounts are refused where meaningless and accepted where meaningful
(withdraw_vesting 0 stops a power-down, delegate 0 removes a delegation)
- truncated op bodies are refused rather than partially parsed
Two fixes to existing tests:
- Three assertions matched rejection strings that the firmware has since
grouped by cause ("malformed op count", "weight out of range",
"mixed active+posting auths"). The text is diagnostic, not contractual —
the protection is that the device refuses — so the assertions follow the
grouping.
- rejects_excluded_and_unknown_ops used op type 3 as its "unknown op",
mislabelled in a comment as comment_options. Op 3 is transfer_to_vesting
and is now clear-signed, so it no longer reached the unknown-op path.
Switched to 49 (recurrent_transfer), which is deliberately out of the
table.
38/38 pass against an emulator built from keepkey-firmware
feat/hive-clearsign-ops-phase3.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hived encodes HIVE as "STEEM" and HBD as "SBD" — the 2020 rebrand renamed the tokens but not their serialization. These tests wrote the display spelling, matching a firmware parser that expected the same wrong bytes, so they passed while every resulting signature was rejected on-chain as "missing required active authority". _asset_raw maps too: its callers target the precision and negative-amount checks, and leaving the display spelling there would trip the symbol check first — passing while testing nothing. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Folds the phase-3 hive test work into
reconcile/upstream-sync, which is the branch.gitmodulesdeclares for firmware pinning. Two commits:38acf57— device tests for the 11 phase-3 clear-sign opse98228f—_asset/_asset_rawemit the wire symbols hived actually uses (STEEM/SBD, notHIVE/HBD)The second is the important one. hived's 2020 rebrand renamed the tokens but not their serialization, so these tests built assets the chain never produces — matching a firmware parser that expected the same wrong bytes. Both sides agreed, every test passed, and every resulting signature was rejected on-chain as "missing required active authority".
_asset_rawmaps too: its callers target the precision and negative-amount checks, and leaving the display spelling there would trip the symbol check first — passing while testing nothing.Pairs with BitHighlander/keepkey-firmware#316, which stops accepting the display spellings. Firmware pins this branch, so the two must land together.
🤖 Generated with Claude Code