Skip to content

feat: guard fee-based token sends on hardware wallets - #885

Merged
raul-oliveira merged 3 commits into
masterfrom
raul-oliveira/feat/ledger-fee-token-guard
Jul 30, 2026
Merged

feat: guard fee-based token sends on hardware wallets#885
raul-oliveira merged 3 commits into
masterfrom
raul-oliveira/feat/ledger-fee-token-guard

Conversation

@raul-oliveira

@raul-oliveira raul-oliveira commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

Acceptance Criteria

  • On a hardware wallet, clicking Send Tokens with a fee-based token shows the "Action not supported" modal and blocks the send, instead of letting the Ledger reject the transaction with a cryptic "Error communicating with Ledger".
  • Software wallets are unaffected: fee-based tokens still send normally.
  • Hardware wallets sending HTR / deposit tokens keep the existing Ledger flow untouched.

Context

The Hathor Ledger app cannot deserialize a transaction that carries a fee header: getDataToSign() appends the FeeHeader bytes after the outputs, and the device's parser rejects the trailing bytes (SW_INVALID_TX). Until the Ledger app learns to parse headers, we block the send early with a clear message, mirroring the existing isLedgerCustomTokenAllowed() guard and reusing the ALERT_NOT_SUPPORTED modal.

The token is detected as fee-based via its version (TokenVersion.FEE), read from the Redux tokens list (kept fresh by useTokensDetails).

Screenshots

image

Security Checklist

  • Make sure you do not include new dependencies in the project unless strictly necessary and do not include dev-dependencies as production ones. — No new dependencies; single-file change in src/screens/SendTokens.js.

Summary by CodeRabbit

  • Bug Fixes
    • Hardware wallet users can no longer attempt to send fee-based tokens.
    • Added a clear alert instructing users to switch to a software wallet before continuing.

@coderabbitai

coderabbitai Bot commented Jul 10, 2026

Copy link
Copy Markdown
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: blocking fee-based token sends on hardware wallets.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch raul-oliveira/feat/ledger-fee-token-guard

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@raul-oliveira
raul-oliveira force-pushed the raul-oliveira/feat/ledger-fee-token-guard branch from c292d0c to 843d11e Compare July 10, 2026 18:35
@raul-oliveira
raul-oliveira requested a review from tuliomir July 10, 2026 18:36
@raul-oliveira raul-oliveira self-assigned this Jul 10, 2026
@raul-oliveira raul-oliveira moved this from Todo to In Progress (Done) in Hathor Network Jul 10, 2026
@raul-oliveira
raul-oliveira changed the base branch from release-candidate to master July 10, 2026 21:37
@github-project-automation github-project-automation Bot moved this from In Progress (Done) to In Review (WIP) in Hathor Network Jul 30, 2026
@raul-oliveira
raul-oliveira merged commit ba75f1a into master Jul 30, 2026
3 checks passed
@github-project-automation github-project-automation Bot moved this from In Review (WIP) to Waiting to be deployed in Hathor Network Jul 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Waiting to be deployed

Development

Successfully merging this pull request may close these issues.

3 participants