The Importance of Transaction Verification

Oct 13, 2025 by wbrum.org 1 views

SECURITY: Users Need to be Allowed to Verify All Parameters of the Transaction

As professional users of the Keystone 3 Pro hardware wallet, we rely on its ability to provide a secure and transparent transaction verification process. However, recent incidents, such as the Bybit hack, have highlighted the importance of verifying all transaction parameters when signing with a hardware wallet. In this article, we will discuss the limitations of the Keystone 3 Pro and how it fails to display crucial transaction information, making it difficult for users to verify the transactions they are signing.

The Importance of Transaction Verification

The main benefit of using a hardware wallet lies in its ability to verify transactions directly on the device's screen, without having to trust the information displayed on the computer. This is particularly important for users who manage a large number of assets and smart contract permissions, such as those using Gnosis Safe. However, the Keystone 3 Pro falls short in this regard, failing to display important transaction parameters that are essential for secure and transparent transactions.

Limitations of the Keystone 3 Pro

ERC20 Transfers

One of the primary limitations of the Keystone 3 Pro is its inability to display the ERC20 token contract address when signing a transaction. This is a critical piece of information that users need to verify the transaction they are signing. While the sender and recipient addresses are displayed, the token contract address is nowhere to be found. This makes it difficult for users to determine which token they are transferring, especially for less common tokens that are not preloaded into the wallet.

Contract Addresses and Function Calls

Another limitation of the Keystone 3 Pro is its inability to display the full input data when signing a transaction that involves a contract address and function call. The transaction input data only displays the first few bytes, making it impossible for users to verify the contract interaction they are signing. This is particularly problematic for users who need to check the full transaction data to ensure that the contract interaction is correct.

Nonce Display

Users also need to see the nonce displayed for every transaction they sign. The nonce is a critical piece of information that helps users verify the transaction they are signing. However, the Keystone 3 Pro fails to display the nonce, making it difficult for users to verify the transaction.

EIP-712 Data

When signing EIP-712 data, the Keystone 3 Pro fails to display which address is signing the transaction, nor does it show the EIP712Domain chain ID or version. This is particularly problematic for users who need to verify which chain they are interacting with or which address is signing the transaction.

In conclusion, the Keystone 3 Pro hardware wallet falls short in its ability to display crucial transaction information, making it difficult for users to verify the transactions they are signing. The limitations of the Keystone 3 Pro, including its inability to display ERC20 token contract addresses, contract addresses and function calls, nonce, and EIP-712 data, make it a less secure option for users who manage a large number of assets and smart contract permissions. We urge the Keystone team to address these issues as soon as possible to provide users with a more secure and transparent transaction verification process.

To address the limitations of the Keystone 3 Pro, we recommend the following:

Display ERC20 token contract addresses: Users need to see the ERC20 token contract address when signing a transaction to verify the token being transferred.
Display full input data: Users need to see the full input data when signing a transaction that involves a contract address and function call to verify the contract interaction.
Display nonce: Users need to see the nonce displayed for every transaction they sign to verify the transaction.
Display EIP-712 data: Users need to see which address is signing the transaction, the EIP712Domain chain ID, and version when signing EIP-712 data to verify the transaction.

By addressing these limitations, the Keystone team can provide users with a more secure and transparent transaction verification process, making the Keystone 3 Pro a more reliable option for users who manage a large number of assets and smart contract permissions.
SECURITY: Users Need to be Allowed to Verify All Parameters of the Transaction

Q&A: Addressing the Limitations of the Keystone 3 Pro Hardware Wallet

In our previous article, we discussed the limitations of the Keystone 3 Pro hardware wallet and how it fails to display crucial transaction information, making it difficult for users to verify the transactions they are signing. In this article, we will address some of the frequently asked questions (FAQs) related to the Keystone 3 Pro and provide answers to help users understand the limitations of the wallet and how to work around them.

Q: Why is it important to verify all transaction parameters?

A: Verifying all transaction parameters is crucial for secure and transparent transactions. By verifying the transaction parameters, users can ensure that they are signing the correct transaction and that the transaction is being executed as intended.

Q: What are the limitations of the Keystone 3 Pro when it comes to ERC20 transfers?

A: The Keystone 3 Pro fails to display the ERC20 token contract address when signing a transaction. This makes it difficult for users to determine which token they are transferring, especially for less common tokens that are not preloaded into the wallet.

Q: How can I verify the ERC20 token contract address when using the Keystone 3 Pro?

A: Unfortunately, the Keystone 3 Pro does not provide a way to display the ERC20 token contract address. However, you can use a third-party tool or service to verify the token contract address before signing the transaction.

Q: What are the limitations of the Keystone 3 Pro when it comes to contract addresses and function calls?

A: The Keystone 3 Pro fails to display the full input data when signing a transaction that involves a contract address and function call. This makes it difficult for users to verify the contract interaction they are signing.

Q: How can I verify the full input data when using the Keystone 3 Pro?

A: Unfortunately, the Keystone 3 Pro does not provide a way to display the full input data. However, you can use a third-party tool or service to verify the input data before signing the transaction.

Q: Why is it important to display the nonce for every transaction?

A: The nonce is a critical piece of information that helps users verify the transaction they are signing. By displaying the nonce, users can ensure that they are signing the correct transaction and that the transaction is being executed as intended.

Q: How can I verify the nonce when using the Keystone 3 Pro?

A: Unfortunately, the Keystone 3 Pro does not provide a way to display the nonce. However, you can use a third-party tool or service to verify the nonce before signing the transaction.

Q: What are the limitations of the Keystone 3 Pro when it comes to EIP-712 data?

A: The Keystone 3 Pro fails to display which address is signing the transaction, nor does it show the EIP712Domain chain ID or version when signing EIP-712 data. This makes it difficult for users to verify which chain they are interacting with or which address is signing the transaction.

Q: How can I verify the EIP-712 data when using the Keystone 3 Pro?

A: Unfortunately, the Keystone 3 Pro does not provide a way to display the EIP-712 data. However, you can use a third-party tool or service to verify the EIP-712 data before signing the transaction.

In conclusion, the Keystone 3 Pro hardware wallet has several limitations that make it difficult for users to verify the transactions they are signing. While the wallet provides a secure and transparent transaction verification process, it falls short in displaying crucial transaction information. By understanding the limitations of the Keystone 3 Pro and using third-party tools or services to verify transaction parameters, users can ensure that they are signing the correct transactions and that the transactions are being executed as intended.

To address the limitations of the Keystone 3 Pro, we recommend the following:

Display ERC20 token contract addresses: Users need to see the ERC20 token contract address when signing a transaction to verify the token being transferred.
Display full input data: Users need to see the full input data when signing a transaction that involves a contract address and function call to verify the contract interaction.
Display nonce: Users need to see the nonce displayed for every transaction they sign to verify the transaction.
Display EIP-712 data: Users need to see which address is signing the transaction, the EIP712Domain chain ID, and version when signing EIP-712 data to verify the transaction.