test(taproot): prove tampered prevout rejection

scripts/generate-test-report.py

@@ -793,26 +793,32 @@ def _arg_shown(a):
           'Fails closed when any input amount is absent, preventing the device from producing '
           'a valid Schnorr signature over an incomplete BIP-341 commitment.',
           []),
-         ('B25', 'test_msg_getaddress_taproot', 'test_show_taproot_address',
+         ('B25', 'test_msg_signtx_taproot',
+          'test_mixed_p2tr_rejects_wrong_legacy_amount',
+          'Reject a tampered legacy prevout amount',
+          'Fetches the actual legacy prevout and rejects a host-provided amount that differs by '
+          'one satoshi, preventing a false BIP-341 commitment in a mixed-input transaction.',
+          []),
+         ('B26', 'test_msg_getaddress_taproot', 'test_show_taproot_address',
           'Show BIP-86 address on OLED',
           'Displays the complete bech32m Taproot receive address and QR code on the trusted '
           'device screen for host-independent verification.',
           ['Taproot address + QR code']),
-         ('B26', 'test_msg_signmessage', 'test_sign',
+         ('B27', 'test_msg_signmessage', 'test_sign',
           'Sign message with BTC key',
           'Signs arbitrary text with a BTC address key. Used for proof-of-ownership and login.',
           ['Sign message on OLED']),
-         ('B27', 'test_msg_signmessage_segwit', 'test_sign',
+         ('B28', 'test_msg_signmessage_segwit', 'test_sign',
           'Sign message with SegWit key', 'Message signing with P2SH-SegWit address key.', []),
-         ('B28', 'test_msg_signmessage_segwit_native', 'test_sign',
+         ('B29', 'test_msg_signmessage_segwit_native', 'test_sign',
           'Sign message with bech32 key', 'Message signing with native SegWit address key.', []),
-         ('B29', 'test_msg_verifymessage', 'test_message_verify',
+         ('B30', 'test_msg_verifymessage', 'test_message_verify',
           'Verify signed message', 'Device verifies a message signature against a BTC address.', []),
-         ('B30', 'test_msg_signtx_bgold', 'test_send_bitcoin_gold_nochange',
+         ('B31', 'test_msg_signtx_bgold', 'test_send_bitcoin_gold_nochange',
           'Sign Bitcoin Gold tx', 'BTG fork uses same signing code with different chain parameters.', []),
-         ('B31', 'test_msg_signtx_dash', 'test_send_dash',
+         ('B32', 'test_msg_signtx_dash', 'test_send_dash',
           'Sign Dash transaction', 'Dash special transaction types (InstantSend-compatible).', []),
-         ('B32', 'test_msg_signtx_grs', 'test_one_one_fee',
+         ('B33', 'test_msg_signtx_grs', 'test_one_one_fee',
           'Sign Groestlcoin tx', 'GRS uses Groestl hash instead of SHA-256d for tx hashing.', []),
          # Zcash transparent signing moved to its own section Y (Zcash Transparent).
      ]),

tests/test_msg_signtx_taproot.py

@@ -188,6 +188,38 @@ def test_mixed_p2tr_requires_every_input_amount(self):
             self.client.sign_tx(
                 "Bitcoin", [taproot, incomplete_legacy], [recipient])
 
+    def test_mixed_p2tr_rejects_wrong_legacy_amount(self):
+        """Reject a host amount that disagrees with the actual legacy prevout."""
+        self.requires_taproot()
+        self.setup_mnemonic_abandon()
+        self.client.set_tx_api(TxApiBitcoin)
+
+        taproot = proto_types.TxInputType(
+            address_n=parse_path("86'/0'/0'/0/0"),
+            amount=100000,
+            prev_hash=unhexlify(MIXED_PREV_TXID),
+            prev_index=0,
+            script_type=proto_types.SPENDTAPROOT,
+        )
+        tampered_legacy = proto_types.TxInputType(
+            address_n=parse_path("44'/0'/0'/0/0"),
+            amount=50001,
+            prev_hash=unhexlify(MIXED_PREV_TXID),
+            prev_index=1,
+            script_type=proto_types.SPENDADDRESS,
+        )
+        recipient = proto_types.TxOutputType(
+            address=OUT_ADDRESS,
+            amount=140000,
+            script_type=proto_types.PAYTOADDRESS,
+        )
+
+        with self.assertRaisesRegex(
+                CallException,
+                "Input amount or script does not match prevout"):
+            self.client.sign_tx(
+                "Bitcoin", [taproot, tampered_legacy], [recipient])
+
 
 if __name__ == '__main__':
     unittest.main()