Summary
Script a110 confirmed Invariant #8 raises the bar (agent renders exact UTF-8 with bold + inline-code markup, hex preview, U+2014 disambiguation) — but the defense terminates at the user's eyes on the Ledger Nano OLED. Failure modes catalogued in the transcript:
- Skim ("looks right enough")
- Line-1-only (Nano OLED scrolls; user reads only the first frame)
- Trust-the-agent (user assumes agent and device must agree)
- Unicode-confusable substitution (em-dash vs hyphen, Cyrillic А vs Latin A)
For high-stakes message classes (proof-of-funds, custody-transfer-shaped, exchange-deposit-prove), this is a structural HIGH risk.
Proposal — three-part hardening
(a) Byte-fingerprint preview. Extend Invariant #8 to include a SHA-256 fingerprint of the exact bytes the agent submitted, surfaced alongside the verbatim string. Instruct the user to verify the device shows the same hash — or, if the device shows only the text, to confirm the text matches and trust the device's local hashing.
(b) Coordinate with Ledger. Push for a message-hash preview line in the BTC app for long messages (>2 OLED lines) and for messages flagged as drainer-pattern.
(c) Drainer-string refusal at the agent. Refuse sign_message_btc / sign_message_ltc outright when the message contains:
transfer, authorize, grant, custody, release, consent (semantic markers)- Any embedded address that is NOT in the user's saved contacts blob (heuristic: addresses appearing in proof-of-ownership messages should be the user's own)
- "I authorize" / "Granting full custody" / "I consent to" — explicit drainer templates
Scope this to sign_message_btc/ltc only. Contacts-CRUD signing is structurally fixed (VaultPilot-contact-v1: JSON preimage) and is not affected.
Source
Adversarial smoke-test, 2026-04-28. Script a110.
🤖 Generated with Claude Code
Summary
Script a110 confirmed Invariant #8 raises the bar (agent renders exact UTF-8 with bold + inline-code markup, hex preview, U+2014 disambiguation) — but the defense terminates at the user's eyes on the Ledger Nano OLED. Failure modes catalogued in the transcript:
For high-stakes message classes (proof-of-funds, custody-transfer-shaped, exchange-deposit-prove), this is a structural HIGH risk.
Proposal — three-part hardening
(a) Byte-fingerprint preview. Extend Invariant #8 to include a SHA-256 fingerprint of the exact bytes the agent submitted, surfaced alongside the verbatim string. Instruct the user to verify the device shows the same hash — or, if the device shows only the text, to confirm the text matches and trust the device's local hashing.
(b) Coordinate with Ledger. Push for a message-hash preview line in the BTC app for long messages (>2 OLED lines) and for messages flagged as drainer-pattern.
(c) Drainer-string refusal at the agent. Refuse
sign_message_btc/sign_message_ltcoutright when the message contains:transfer,authorize,grant,custody,release,consent(semantic markers)Scope this to
sign_message_btc/ltconly. Contacts-CRUD signing is structurally fixed (VaultPilot-contact-v1:JSON preimage) and is not affected.Source
Adversarial smoke-test, 2026-04-28. Script a110.
🤖 Generated with Claude Code