@chainberry/trust-wallet-core 2.5.0 → 2.5.2

package/ChainberryTrustWalletCoreModule.podspec

@@ -10,12 +10,19 @@ Pod::Spec.new do |s|
   s.homepage       = 'https://github.com/Chainberry-com/trust-wallet-core'
   s.license        = package['license']
   s.author         = 'Chainberry'
-  s.platform       = :ios, '16.0'
+  s.platform       = :ios, '15.1'
   s.source         = { git: 'git@github.com:Chainberry-com/trust-wallet-core.git', tag: "v#{package['version']}" }
   s.static_framework = true
 
-  s.source_files = 'ios/**/*.{h,m,mm,swift}'
+  s.source_files         = 'ios/**/*.{h,m,mm,swift}'
+  s.exclude_files        = 'ios/ConformanceTests/**'
 
   s.dependency 'ExpoModulesCore'
   s.dependency 'TrustWalletCore', '4.1.19'
+
+  s.test_spec 'ConformanceTests' do |ts|
+    ts.source_files = 'ios/ConformanceTests/*.swift'
+    ts.dependency 'TrustWalletCore', '4.1.19'
+    ts.resources = ['conformance/signing-vectors.json', 'conformance/address-derivation-vectors.json']
+  end
 end

package/README.md

@@ -10,7 +10,7 @@ Supported chains: Ethereum, BNB Smart Chain, Polygon, Solana, Tron, TON, Bitcoin
 npx expo install @chainberry/trust-wallet-core
 ```
 
-This is an Expo config plugin module with native Android/iOS code, so it requires a development build (`expo prebuild` / EAS Build) — it will not work in Expo Go.
+This is an Expo native module with native Android/iOS code. It uses Expo's autolinking mechanism and does not ship an Expo config plugin. A development build is required (`expo prebuild` / EAS Build) — it will not work in Expo Go.
 
 ### Android: no GitHub credentials needed
 
@@ -24,10 +24,43 @@ GitHub Packages auth is still needed (via `GITHUB_ACTOR`/`GITHUB_TOKEN` env vars
 
 Android biometric gating additionally pulls in `androidx.biometric:biometric:1.1.0`.
 
+## Publish
+
+This package is consumed by the app via `file:modules/trust-wallet-core` (see the root
+`package.json`), not an npm workspace under `packages/*` — so, unlike
+`@chainberry/expo-wallet-sdk`, there's no `-w` flag to use; run these from inside this directory.
+There's also no build step: this package ships its TypeScript source directly (`main`/`types`
+point at `src/index.ts`), so no `prepublishOnly` rebuild happens either.
+
+1. Bump the version (in `package.json`, or via):
+   ```sh
+   cd modules/trust-wallet-core
+   npm version patch   # or minor / major
+   ```
+2. Dry-run first — prints exactly what would be published without touching the registry:
+   ```sh
+   npm publish --dry-run
+   ```
+3. Publish for real:
+   ```sh
+   npm publish
+   ```
+   `publishConfig.access: "public"` in this package's own `package.json` already covers the
+   `--access public` flag scoped packages otherwise need.
+
+Requires npm registry publish auth (an `_authToken` for `@chainberry`, e.g. via `.npmrc` — not
+committed to git). This is separate from the GitHub Packages auth mentioned above, which is only
+needed for bumping the pinned Android wallet-core artifact, not for publishing this npm package.
+
 ## Usage
 
 ```ts
-import { createWallet, importWallet, signTransaction, exportMnemonic } from "@chainberry/trust-wallet-core";
+import {
+  createWallet,
+  importWallet,
+  signTransaction,
+  exportMnemonic,
+} from "@chainberry/trust-wallet-core";
 
 const { walletId, addresses } = await createWallet(); // 128-bit / 12-word by default
 // addresses: { ethereum: "0x...", solana: "...", bnb: "0x...", bitcoin: "...", ... }
@@ -46,7 +79,7 @@ const mnemonic = await exportMnemonic(walletId);
 - `createWallet(strength = 128)` — generates a new BIP-39 mnemonic and persists it natively (Keychain on iOS / Keystore-backed file on Android, biometry-or-passcode gated). Returns `{ walletId, addresses }` — the mnemonic itself never leaves native code. No BIP-39 passphrase support: `signTransaction` always reconstructs the wallet with an empty passphrase, so a caller-supplied one would derive addresses from a seed different from the one actually used to sign.
 - `importWallet(mnemonic)` — validates and persists an existing mnemonic the same way. The `mnemonic` argument is a one-time exposure from the caller (e.g. a text-entry backup-restore screen); discard your own copy immediately after this call resolves.
 - `listWallets()` — returns `{ walletId, addresses }[]` for every persisted wallet, reading only the ungated metadata store. No biometric prompt.
-- `deleteWallet(walletId)` — removes the wallet's native key material and metadata entry. Irreversible; not biometric-gated (deleting reveals nothing, so this is a UX confirmation concern, not a key-secrecy one).
+- `deleteWallet(walletId)` — removes the wallet's native key material and metadata entry. Irreversible; requires a fresh biometric/passcode confirmation before deletion proceeds on both platforms.
 - `signTransaction(walletId, chain, unsignedTx)` — triggers a native biometry/passcode prompt, then derives the key and signs entirely inside native code. Returns `{ signedTx, meta? }`; `meta` currently only carries TON's `txHash`.
 - `exportMnemonic(walletId)` — the one sanctioned mnemonic exposure. Biometry/passcode gated. Use only for an explicit "reveal recovery phrase" backup screen; don't hold the result in app state beyond that screen's lifetime.
 
@@ -64,9 +97,13 @@ Both platforms pin **Trust Wallet Core 4.1.19** (`com.trustwallet:wallet-core:4.
 
 **Address derivation is verified for all 10 chains** in `conformance/address-derivation-vectors.json`, asserted by the Android instrumented test (`src/androidTest/.../AddressDerivationConformanceTest.kt`; run via `./gradlew connectedDebugAndroidTest`). Methodology: real on-device 4.1.19 addresses were harvested from the instrumented test running on an emulator, cross-checked against an independent derivation via the WASM build (`@trustwallet/wallet-core` 3.3.3, run standalone in Node — a different upstream release than the pinned 4.1.19, used only as a second data point); on-device 4.1.19 is authoritative wherever the two disagree, since that's what the app actually ships. They agreed on 6 of 7 previously-pending chains exactly; `ton` disagreed only in address-flag encoding (bounceable vs. non-bounceable — same underlying key/hash, see that fixture entry's `_note`). This same run also caught a real bug: the Ethereum/BNB/Polygon address that had been marked `"verified"` since before this pass was actually wrong — the instrumented test that should have caught it had never successfully executed (two pre-existing bugs: `coin.name()` didn't compile against this Kotlin binding, and no `testInstrumentationRunner` was configured, so `connectedAndroidTest` silently ran "0 tests" instead of failing). Both are fixed now; see the test file's header comment for details.
 
-**Byte-for-byte signing output is verified for 8 of 9 signable chains** in `conformance/signing-vectors.json`, asserted by `src/androidTest/.../SigningConformanceTest.kt`. Each vector calls `ChainSigner.sign()` — the same call path production code uses — with a fixed, deterministic (not necessarily broadcast-valid) unsigned tx. `ton` is verified but *not* byte-exact-asserted: `signTon()` embeds a wall-clock `expireAt` into the signed payload, so its output legitimately differs every run — the test instead checks the output is a well-formed signed BOC. `bitcoincash` has no signing vector (sending is unsupported, see above).
+**Byte-for-byte signing output is verified for 8 of 9 signable chains** in `conformance/signing-vectors.json`, asserted by `src/androidTest/.../SigningConformanceTest.kt`. Each vector calls `ChainSigner.sign()` — the same call path production code uses — with a fixed, deterministic (not necessarily broadcast-valid) unsigned tx. `ton` is verified but _not_ byte-exact-asserted: `signTon()` embeds a wall-clock `expireAt` into the signed payload, so its output legitimately differs every run — the test instead checks the output is a well-formed signed BOC. `bitcoincash` has no signing vector (sending is unsupported, see above).
+
+Both Android suites are CI-gated on every push/PR (`.github/workflows/ci.yml`'s `android-unit-tests` and `android-instrumented-tests` jobs, via `example/` — see that folder's README for why an Expo host app is needed to build this module at all). iOS is CI-gated via the `ios-conformance-tests` job: `expo prebuild` generates the Xcode workspace, `pod install` wires up the `ConformanceTests` test_spec declared in the podspec (CocoaPods includes test_specs automatically — there is no `--include-test-specs` flag), and `xcodebuild test` runs both `AddressDerivationConformanceTests` and `SigningConformanceTests` on an iPhone 16 simulator.
+
+**Tron divergence resolved.** iOS's `signTron` used to hand wallet-core the full `rawJson` and return its own reconstruction, diverging from Android's `txId`-only input + manual JSON reassembly — and `TronSigningInput` has no `rawJson` field in the pinned 4.1.19 anyway, so the old iOS code didn't compile. iOS now signs the same way Android does: `TronSigningInput.txID` set to the digest, signature reassembled into `{...tx, signature}` in app code (see `ios/ChainSigning.swift`'s `signTron`). Same key + same digest is guaranteed to produce the same ECDSA signature, so this is a structural fix, not something that needs a device to confirm.
 
-**iOS gap — not closed by this pass.** No Swift/Xcode toolchain was available in the environment that did this verification, so none of the above has been independently confirmed on iOS. `ChainKey.coinType` maps identically to Android's, so derivation *should* match, but this hasn't been checked on-device. `ConformanceTests/` currently has no address-derivation or signing test target at all (only the pre-existing amount-parsing one) — before this finding is fully closed for both platforms, an iOS engineer needs to (1) add `AddressDerivationConformanceTests`/`SigningConformanceTests` targets mirroring the Android ones, (2) run them against these same fixtures on a Mac, and (3) specifically resolve the **Tron divergence**: Android's `signTron` signs just the `txId` digest and reassembles JSON in app code, while iOS's hands wallet-core the full `rawJson` and returns its own reconstruction — `conformance/signing-vectors.json`'s `tron` entry spells out exactly what to check (the embedded signature hex must match Android's byte-for-byte; a mismatch there is a real bug, not a formatting difference).
+**iOS conformance suites are wired via CocoaPods `test_spec`.** `ios/ConformanceTests/AddressDerivationConformanceTests.swift` and `SigningConformanceTests.swift` mirror the Android fixtures above (all 10 address-derivation chains, the same 8 signing vectors, including a `testTron()` that asserts the reassembled signature matches Android's byte-for-byte). Both are declared as a `test_spec 'ConformanceTests'` in `ChainberryTrustWalletCoreModule.podspec`, which links them against `TrustWalletCore 4.1.19` and embeds the JSON fixtures as bundle resources. Running `pod install` from `example/ios` creates the `ChainberryTrustWalletCoreModule-ConformanceTests` scheme in the workspace automatically. The `ConformanceTests/` SwiftPM package continues to test only amount-parsing (no WalletCore dependency, runs standalone via `swift test`). The `tron` signing vector remains `"verified-android-only"` in the JSON until the iOS CI job's first green run confirms the signature matches byte-for-byte.
 
 ## License
 

package/android/src/androidTest/java/com/chainberry/trustwalletcore/AddressDerivationConformanceTest.kt

@@ -44,7 +44,7 @@ class AddressDerivationConformanceTest {
 
     // Chains with expected addresses confirmed against WalletCore 4.1.19, on a real device/emulator.
     // ETH / BNB / POL all share CoinType.ETHEREUM (same secp256k1 key, BIP44 m/44'/60'/0'/0/0).
-    val VERIFIED = mapOf(
+    val verified = mapOf(
       CoinType.ETHEREUM to "0x9858EfFD232B4033E47d90003D41EC34EcaEda94", // ethereum / bnb / polygon
       CoinType.SMARTCHAIN to "0x9858EfFD232B4033E47d90003D41EC34EcaEda94", // bnb (same key as ethereum)
       CoinType.BITCOIN to "bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu",
@@ -63,13 +63,13 @@ class AddressDerivationConformanceTest {
 
     // Steady state is empty — add a chain's CoinType here (and drop it from VERIFIED) only while
     // actively harvesting a newly-added chain's address for the first time.
-    val PENDING = emptyList<CoinType>()
+    val pending = emptyList<CoinType>()
   }
 
   @Test
   fun verifiedAddressesMatch() {
     val wallet = HDWallet(MNEMONIC, "")
-    for ((coin, expected) in VERIFIED) {
+    for ((coin, expected) in verified) {
       val actual = wallet.getAddressForCoin(coin)
       assertEquals("address mismatch for coin=${coin.name}", expected, actual)
     }
@@ -96,7 +96,7 @@ class AddressDerivationConformanceTest {
   @Test
   fun printPendingAddressesForVerification() {
     val wallet = HDWallet(MNEMONIC, "")
-    val lines = PENDING.map { coin -> "  ${coin.name} -> ${wallet.getAddressForCoin(coin)}" }
+    val lines = pending.map { coin -> "  ${coin.name} -> ${wallet.getAddressForCoin(coin)}" }
     println(
       "\n[AddressDerivationConformanceTest] Pending — verify and move to VERIFIED map:\n" +
         lines.joinToString("\n")

package/android/src/androidTest/java/com/chainberry/trustwalletcore/SigningConformanceTest.kt

@@ -125,7 +125,7 @@ class SigningConformanceTest {
     // methodology). "ton" is deliberately absent — signTon() embeds a wall-clock
     // `expireAt = now + 600s` into the signed payload, so its output is never byte-reproducible
     // across runs; see tonVectorIsWellFormed() below for what's actually checked instead.
-    val EXPECTED: Map<String, String> = mapOf(
+    val expectedOutputs: Map<String, String> = mapOf(
       "ethereum" to "0xf86c808504a817c800825208949858effd232b4033e47d90003d41ec34ecaeda94880de0b6b3a76400008026a0b7cca5f69561cd482cec4e692bd2da17d9eb1d6b3a83fe3f7f11d117de99ca97a00ad0dc153460e39b355c226a2744fc2926f84b95b89c954551571f1bbc251478",
       "polygon" to "0x02f874818980843b9aca008509502f9000825208949858effd232b4033e47d90003d41ec34ecaeda94880de0b6b3a764000080c001a038b5c72ee38aa18607462b80ab0cb170a8d4df1c4090ac49acd41d6b4b0f9acca05bdee390ee8a50ff569f55d408371213df72a3065902b07317289b39788cb434",
       "bitcoin" to "0100000000010100000000000000000000000000000000000000000000000000000000000000000000000000000000000250c3000000000000160014c0cebcd6c3d3ca8c75dc5ec62ebe55330ef910e2cebd000000000000160014c0cebcd6c3d3ca8c75dc5ec62ebe55330ef910e20247304402201e8f3663c97712bbf662c96df532e701ca9b660b507ab170d7b4ffbd966d4be0022033bd537c7720b1e7be2b7663d1a0adcbe565ff18a25794aec828015529ab80e101210330d54fd0dd420a6e5f8d3624f5f3482cae350f79d5f0753bf5beef9c2d91af3c00000000",
@@ -160,7 +160,7 @@ class SigningConformanceTest {
   fun signedOutputsMatch() {
     val wallet = HDWallet(MNEMONIC, "")
     for ((chain, pair) in vectors()) {
-      val expected = EXPECTED[chain] ?: continue
+      val expected = expectedOutputs[chain] ?: continue
       val (chainKey, unsignedTx) = pair
       val actual = ChainSigner.sign(chainKey, wallet, unsignedTx, isTestnet = false).signedTx
       assertEquals("signed output mismatch for chain=$chain", expected, actual)

package/android/src/main/java/com/chainberry/trustwalletcore/ChainSigning.kt

@@ -13,11 +13,14 @@ import wallet.core.jni.Hash
 import wallet.core.jni.PrivateKey
 import wallet.core.jni.SolanaTransaction
 import wallet.core.jni.TransactionDecoder
+import wallet.core.jni.proto.Aptos
 import wallet.core.jni.proto.Bitcoin
 import wallet.core.jni.proto.Common
+import wallet.core.jni.proto.Cosmos
 import wallet.core.jni.proto.Ethereum
 import wallet.core.jni.proto.Ripple
 import wallet.core.jni.proto.Solana
+import wallet.core.jni.proto.Tezos
 import wallet.core.jni.proto.TheOpenNetwork
 import wallet.core.jni.proto.Tron
 import java.math.BigInteger
@@ -51,13 +54,19 @@ enum class ChainKey(val coinType: CoinType) {
   BITCOINCASH(CoinType.BITCOINCASH),
   DOGECOIN(CoinType.DOGECOIN),
   LITECOIN(CoinType.LITECOIN),
-  XRP(CoinType.XRP);
+  XRP(CoinType.XRP),
+  COSMOS(CoinType.COSMOS),
+  APTOS(CoinType.APTOS),
+  TEZOS(CoinType.TEZOS);
 
   val symbol: String get() = when (this) {
     ETHEREUM -> "ETH"; BNB -> "BNB"; POLYGON -> "POL"
     AVAX -> "AVAX"; BASE -> "ETH"; ARBITRUM -> "ETH"; OPTIMISM -> "ETH"; SONIC -> "S"
     SOLANA -> "SOL"; TRON -> "TRX"; TON -> "TON"
     BITCOIN -> "BTC"; BITCOINCASH -> "BCH"; DOGECOIN -> "DOGE"; LITECOIN -> "LTC"; XRP -> "XRP"
+    COSMOS -> "ATOM"
+    APTOS -> "APT"
+    TEZOS -> "XTZ"
   }
 
   companion object {
@@ -144,6 +153,9 @@ object ChainSigner {
     ChainKey.XRP -> ChainSignResult(signXrp(wallet, unsignedTx), null)
     ChainKey.TON -> signTon(wallet, unsignedTx)
     ChainKey.BITCOINCASH -> ChainSignResult(signBch(wallet, unsignedTx), null)
+    ChainKey.COSMOS -> ChainSignResult(signCosmos(wallet, unsignedTx), null)
+    ChainKey.APTOS -> ChainSignResult(signAptos(wallet, unsignedTx), null)
+    ChainKey.TEZOS -> ChainSignResult(signTezos(wallet, unsignedTx), null)
   }
 
   // MARK: - EVM (ethereum / bnb / polygon)
@@ -432,6 +444,170 @@ object ChainSigner {
     if (output.error != Common.SigningError.OK) throw ChainSigningException("Signing failed: ${output.errorMessage}")
     return ChainSignResult(output.encoded, mapOf("txHash" to output.hash.toByteArray().toHex()))
   }
+
+  // MARK: - Cosmos (ATOM)
+  // unsignedTx: { accountNumber, sequence, chainId, feeAmount, gas, memo, fromAddress, toAddress,
+  //               amount (uatom, decimal string), denom }
+  // Returns output.serialized — ready-to-broadcast JSON for the Cosmos LCD.
+  private fun signCosmos(wallet: HDWallet, unsignedTx: Map<String, Any>): String {
+    val privateKey = wallet.getKeyForCoin(CoinType.COSMOS)
+    val fromAddress = unsignedTx["fromAddress"] as? String ?: throw ChainSigningException("Missing fromAddress")
+    val toAddress = unsignedTx["toAddress"] as? String ?: throw ChainSigningException("Missing toAddress")
+    val amountStr = unsignedTx["amount"] as? String ?: throw ChainSigningException("Missing amount")
+    val feeAmountStr = unsignedTx["feeAmount"] as? String ?: throw ChainSigningException("Missing feeAmount")
+    val denom = unsignedTx["denom"] as? String ?: throw ChainSigningException("Missing denom")
+    val chainId = unsignedTx["chainId"] as? String ?: throw ChainSigningException("Missing chainId")
+    val accountNumber = (unsignedTx["accountNumber"] as? Number)?.toLong() ?: throw ChainSigningException("Missing accountNumber")
+    val sequence = (unsignedTx["sequence"] as? Number)?.toLong() ?: throw ChainSigningException("Missing sequence")
+    val gas = (unsignedTx["gas"] as? Number)?.toLong() ?: throw ChainSigningException("Missing gas")
+    val memo = unsignedTx["memo"] as? String ?: ""
+
+    val sendAmount = Cosmos.Amount.newBuilder()
+      .setAmount(amountStr)
+      .setDenom(denom)
+      .build()
+
+    val sendMsg = Cosmos.Message.Send.newBuilder()
+      .setFromAddress(fromAddress)
+      .setToAddress(toAddress)
+      .addAmounts(sendAmount)
+      .build()
+
+    val message = Cosmos.Message.newBuilder()
+      .setSendCoinsMessage(sendMsg)
+      .build()
+
+    val feeAmount = Cosmos.Amount.newBuilder()
+      .setAmount(feeAmountStr)
+      .setDenom(denom)
+      .build()
+
+    val fee = Cosmos.Fee.newBuilder()
+      .setGas(gas)
+      .addAmounts(feeAmount)
+      .build()
+
+    val input = Cosmos.SigningInput.newBuilder().apply {
+      this.signingMode = Cosmos.SigningMode.Protobuf
+      this.accountNumber = accountNumber
+      this.chainId = chainId
+      this.sequence = sequence
+      this.memo = memo
+      this.fee = fee
+      this.addMessages(message)
+      this.privateKey = ByteString.copyFrom(privateKey.data())
+      this.mode = Cosmos.BroadcastMode.SYNC
+    }.build()
+
+    val output = AnySigner.sign(input, CoinType.COSMOS, Cosmos.SigningOutput.parser())
+    if (output.error != Common.SigningError.OK) throw ChainSigningException("Cosmos signing failed: ${output.errorMessage}")
+    return output.serialized
+  }
+
+  // MARK: - Aptos (APT)
+  // unsignedTx: { sender, sequenceNumber, maxGasAmount, gasUnitPrice, expirationTimestampSecs,
+  //              chainId, toAddress, amount (octas, decimal string) }
+  // Returns output.json — the signed JSON body posted directly to the Aptos REST API.
+  private fun signAptos(wallet: HDWallet, unsignedTx: Map<String, Any>): String {
+    val privateKey = wallet.getKeyForCoin(CoinType.APTOS)
+    val sender = unsignedTx["sender"] as? String ?: throw ChainSigningException("Missing sender")
+    val toAddress = unsignedTx["toAddress"] as? String ?: throw ChainSigningException("Missing toAddress")
+    val amountStr = unsignedTx["amount"] as? String ?: throw ChainSigningException("Missing amount")
+    val sequenceNumber = (unsignedTx["sequenceNumber"] as? Number)?.toLong() ?: throw ChainSigningException("Missing sequenceNumber")
+    val maxGasAmount = (unsignedTx["maxGasAmount"] as? Number)?.toLong() ?: throw ChainSigningException("Missing maxGasAmount")
+    val gasUnitPrice = (unsignedTx["gasUnitPrice"] as? Number)?.toLong() ?: throw ChainSigningException("Missing gasUnitPrice")
+    val expirationTimestampSecs = (unsignedTx["expirationTimestampSecs"] as? Number)?.toLong() ?: throw ChainSigningException("Missing expirationTimestampSecs")
+    val chainId = (unsignedTx["chainId"] as? Number)?.toInt() ?: throw ChainSigningException("Missing chainId")
+    val amountOctas = amountStr.toLongOrNull() ?: throw ChainSigningException("Invalid Aptos amount: $amountStr")
+
+    val transfer = Aptos.TransferMessage.newBuilder()
+      .setTo(toAddress)
+      .setAmount(amountOctas)
+      .build()
+
+    val input = Aptos.SigningInput.newBuilder()
+      .setSender(sender)
+      .setSequenceNumber(sequenceNumber)
+      .setMaxGasAmount(maxGasAmount)
+      .setGasUnitPrice(gasUnitPrice)
+      .setExpirationTimestampSecs(expirationTimestampSecs)
+      .setChainId(chainId)
+      .setPrivateKey(ByteString.copyFrom(privateKey.data()))
+      .setTransfer(transfer)
+      .build()
+
+    val output = AnySigner.sign(input, CoinType.APTOS, Aptos.SigningOutput.parser())
+    if (output.error != Common.SigningError.OK) throw ChainSigningException("Aptos signing failed: ${output.errorMessage}")
+    return output.json
+  }
+
+  // MARK: - Tezos (XTZ)
+  // unsignedTx: { branch, fromAddress, toAddress, counter, amount (mutez), fee (mutez),
+  //              gasLimit, storageLimit, needsReveal }
+  // Returns output.encoded hex — broadcast via POST /injection/operation as JSON-encoded string.
+  private fun signTezos(wallet: HDWallet, unsignedTx: Map<String, Any>): String {
+    val privateKey = wallet.getKeyForCoin(CoinType.TEZOS)
+    val branch = unsignedTx["branch"] as? String ?: throw ChainSigningException("Missing branch")
+    val fromAddress = unsignedTx["fromAddress"] as? String ?: throw ChainSigningException("Missing fromAddress")
+    val toAddress = unsignedTx["toAddress"] as? String ?: throw ChainSigningException("Missing toAddress")
+    val counter = (unsignedTx["counter"] as? Number)?.toLong() ?: throw ChainSigningException("Missing counter")
+    val amount = (unsignedTx["amount"] as? Number)?.toLong() ?: throw ChainSigningException("Missing amount")
+    val fee = (unsignedTx["fee"] as? Number)?.toLong() ?: throw ChainSigningException("Missing fee")
+    val gasLimit = (unsignedTx["gasLimit"] as? Number)?.toLong() ?: throw ChainSigningException("Missing gasLimit")
+    val storageLimit = (unsignedTx["storageLimit"] as? Number)?.toLong() ?: throw ChainSigningException("Missing storageLimit")
+    val needsReveal = unsignedTx["needsReveal"] as? Boolean ?: false
+
+    val operations = mutableListOf<Tezos.Operation>()
+
+    if (needsReveal) {
+      val pubKey = privateKey.getPublicKeyEd25519()
+      val revealData = Tezos.RevealOperationData.newBuilder()
+        .setPublicKey(ByteString.copyFrom(pubKey.data()))
+        .build()
+      operations.add(
+        Tezos.Operation.newBuilder()
+          .setSource(fromAddress)
+          .setCounter(counter - 1)
+          .setFee(1420L)
+          .setGasLimit(10600L)
+          .setStorageLimit(0L)
+          .setKind(Tezos.Operation.OperationKind.REVEAL)
+          .setRevealOperationData(revealData)
+          .build()
+      )
+    }
+
+    val txData = Tezos.TransactionOperationData.newBuilder()
+      .setDestination(toAddress)
+      .setAmount(amount)
+      .build()
+
+    operations.add(
+      Tezos.Operation.newBuilder()
+        .setSource(fromAddress)
+        .setCounter(counter)
+        .setFee(fee)
+        .setGasLimit(gasLimit)
+        .setStorageLimit(storageLimit)
+        .setKind(Tezos.Operation.OperationKind.TRANSACTION)
+        .setTransactionOperationData(txData)
+        .build()
+    )
+
+    val opList = Tezos.OperationList.newBuilder()
+      .setBranch(branch)
+      .addAllOperations(operations)
+      .build()
+
+    val input = Tezos.SigningInput.newBuilder()
+      .setOperationList(opList)
+      .setPrivateKey(ByteString.copyFrom(privateKey.data()))
+      .build()
+
+    val output = AnySigner.sign(input, CoinType.TEZOS, Tezos.SigningOutput.parser())
+    if (output.error != Common.SigningError.OK) throw ChainSigningException("Tezos signing failed: ${output.errorMessage}")
+    return output.encoded.toByteArray().toHex()
+  }
 }
 
 // Transaction summary helpers (used by ChainberryTrustWalletCoreModule for native confirmation UI)
@@ -450,12 +626,42 @@ internal fun ChainSigner.buildSummary(chain: ChainKey, unsignedTx: Map<String, A
       )
       val feeWei = gasLimit * gasPrice
       if (feeWei > 0) lines += "Max fee: ${fmtAmt(feeWei / 1e18)} ${chain.symbol}"
+      (unsignedTx["chainId"] as? Number)?.let { lines += "Chain ID: ${it.toInt()}" }
+      (unsignedTx["nonce"] as? Number)?.let { lines += "Nonce: ${it.toInt()}" }
+      val dataHex = (unsignedTx["dataHex"] as? String) ?: ""
+      val stripped = dataHex.removePrefix("0x")
+      if (stripped.isNotEmpty() && stripped != "0") {
+        val sel = stripped.take(8).lowercase()
+        if (sel == "a9059cbb" && stripped.length >= 136) {
+          // transfer(address recipient, uint256 amount)
+          val recipient = "0x" + stripped.drop(32).take(40)
+          val amountHex = stripped.drop(72).take(64).trimStart('0').ifEmpty { "0" }
+          lines += "Token transfer to: ${fmtAddr(recipient)}"
+          lines += "Token amount (raw units): 0x$amountHex"
+        } else if (sel == "23b872dd" && stripped.length >= 200) {
+          // transferFrom(address from, address to, uint256 amount)
+          val to = "0x" + stripped.drop(96).take(40)
+          val amountHex = stripped.drop(136).take(64).trimStart('0').ifEmpty { "0" }
+          lines += "Token transfer to: ${fmtAddr(to)}"
+          lines += "Token amount (raw units): 0x$amountHex"
+        } else {
+          lines += "Contract data: ${stripped.length / 2} bytes — review carefully"
+        }
+      }
     }
     ChainKey.BITCOIN, ChainKey.DOGECOIN, ChainKey.LITECOIN -> {
       (unsignedTx["toAddress"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
-      (unsignedTx["sendAmountSats"] as? String)?.toLongOrNull()?.let {
-        lines += "Amount: ${fmtAmt(it.toDouble() / 1e8)} ${chain.symbol}"
-      }
+      val sendSats = (unsignedTx["sendAmountSats"] as? String)?.toLongOrNull() ?: 0L
+      if (sendSats > 0) lines += "Amount: ${fmtAmt(sendSats.toDouble() / 1e8)} ${chain.symbol}"
+      (unsignedTx["changeAddress"] as? String)?.let { lines += "Change to: ${fmtAddr(it)}" }
+      (unsignedTx["satsPerByte"] as? Number)?.let { lines += "Fee rate: ${it.toInt()} sat/vB" }
+      @Suppress("UNCHECKED_CAST")
+      val inputTotal = (unsignedTx["inputs"] as? List<Map<String, Any>>)
+        ?.mapNotNull { (it["amountSats"] as? String)?.toLongOrNull() }
+        ?.fold(0L, Long::plus) ?: 0L
+      val changeSats = (unsignedTx["changeAmountSats"] as? String)?.toLongOrNull() ?: 0L
+      val totalFee = inputTotal - sendSats - changeSats
+      if (totalFee > 0) lines += "Total fee: ${fmtAmt(totalFee.toDouble() / 1e8)} ${chain.symbol}"
     }
     ChainKey.XRP -> {
       (unsignedTx["Destination"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
@@ -472,34 +678,203 @@ internal fun ChainSigner.buildSummary(chain: ChainKey, unsignedTx: Map<String, A
       (unsignedTx["amount"] as? String)?.toULongOrNull()?.let {
         lines += "Amount: ${fmtAmt(it.toDouble() / 1e9)} TON"
       }
+      val memoTon = (unsignedTx["memoId"] as? String)?.takeIf { it.isNotEmpty() }
+      memoTon?.let { lines += "Memo: $it" }
+      lines += "Fee: ${if (memoTon != null) "~0.006" else "~0.005"} TON (estimate)"
     }
     ChainKey.TRON -> {
       @Suppress("UNCHECKED_CAST")
-      val value = ((unsignedTx["raw_data"] as? Map<String, Any>)
+      val firstContract = (unsignedTx["raw_data"] as? Map<String, Any>)
         ?.let { (it["contract"] as? List<Map<String, Any>>)?.firstOrNull() }
-        ?.let { it["parameter"] as? Map<String, Any> }
-        ?.let { it["value"] as? Map<String, Any> })
-      value?.let { v ->
-        (v["to_address"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
-        (v["amount"] as? Number)?.let { lines += "Amount: ${fmtAmt(it.toDouble() / 1e6)} TRX" }
+      firstContract?.let { contract ->
+        val contractType = contract["type"] as? String ?: ""
+        val value = (contract["parameter"] as? Map<String, Any>)
+          ?.let { it["value"] as? Map<String, Any> }
+        when (contractType) {
+          "TransferContract" -> value?.let { v ->
+            (v["to_address"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
+            (v["amount"] as? Number)?.let { lines += "Amount: ${fmtAmt(it.toDouble() / 1e6)} TRX" }
+          }
+          "TriggerSmartContract" -> value?.let { v ->
+            (v["contract_address"] as? String)?.let { lines += "Token contract: ${fmtAddr(it)}" }
+            val dataHex = (v["data"] as? String) ?: ""
+            val stripped = dataHex.removePrefix("0x")
+            val sel = stripped.take(8).lowercase()
+            if (sel == "a9059cbb" && stripped.length >= 136) {
+              // TRC-20 transfer(address, uint256) — ABI encoding identical to EVM
+              val recipientHex = "0x" + stripped.drop(32).take(40)
+              val amountHex = stripped.drop(72).take(64).trimStart('0').ifEmpty { "0" }
+              lines += "TRC-20 to: ${fmtAddr(recipientHex)}"
+              lines += "Token amount (raw units): 0x$amountHex"
+            } else {
+              lines += "Contract call: ${stripped.length / 2} bytes — review carefully"
+            }
+          }
+          else -> if (contractType.isNotEmpty()) lines += "Contract type: $contractType — review carefully"
+        }
+      }
+      // Verify txID == SHA256(raw_data_hex). Both fields must be present — fail closed if either
+      // is absent so a JS caller cannot suppress the integrity check by omitting raw_data_hex.
+      val txId = unsignedTx["txID"] as? String
+        ?: throw ChainSigningException("TRX txID missing — signing refused")
+      val rawHex = unsignedTx["raw_data_hex"] as? String
+        ?: throw ChainSigningException("TRX raw_data_hex missing — cannot verify txID, signing refused")
+      val computed = java.security.MessageDigest.getInstance("SHA-256")
+        .digest(rawHex.hexToBytes()).toHex()
+      if (computed.lowercase() != txId.lowercase())
+        throw ChainSigningException("TRX txID does not match SHA256(raw_data_hex) — signing refused")
+      lines += "TxID verified ✓"
+    }
+    ChainKey.SOLANA -> {
+      val info = (unsignedTx["unsignedTxBase64"] as? String)?.let { decodeSolanaForSummary(it) }
+        ?: throw ChainSigningException(
+          "Cannot decode Solana transaction — signing refused to prevent blind signing"
+        )
+      if (info.isSplTransfer) {
+        info.splDest?.let { lines += "SPL Token to: ${fmtAddr(it)}" }
+        info.splAmount?.let { lines += "SPL Token amount (raw): $it" }
+      } else {
+        info.to?.let { lines += "To: ${fmtAddr(it)}" }
+        info.lamports?.let { lines += "Amount: ${fmtAmt(it.toDouble() / 1e9)} SOL" }
+        if (!info.isTransfer) lines += "Non-transfer instruction — review carefully"
       }
     }
-    ChainKey.SOLANA -> lines += "(Solana — details verified by the network)"
     ChainKey.BITCOINCASH -> {
-      try {
-        val descriptor = JSONObject((unsignedTx["unsignedDescriptorJson"] as? String) ?: "")
-        descriptor.optString("toAddress").takeIf { it.isNotEmpty() }?.let { lines += "To: ${fmtAddr(it)}" }
-        val sats = descriptor.optLong("sendAmountSats", -1L)
-        if (sats >= 0) lines += "Amount: ${fmtAmt(sats.toDouble() / 1e8)} BCH"
-      } catch (_: Exception) {}
+      // Fail closed — if descriptor is absent or unparseable we cannot show what will be signed.
+      val descriptorJson = unsignedTx["unsignedDescriptorJson"] as? String
+        ?: throw ChainSigningException("Cannot decode BCH descriptor — signing refused to prevent blind signing")
+      val descriptor = try {
+        JSONObject(descriptorJson)
+      } catch (_: Exception) {
+        throw ChainSigningException("Cannot parse BCH descriptor JSON — signing refused")
+      }
+      descriptor.optString("toAddress").takeIf { it.isNotEmpty() }?.let { lines += "To: ${fmtAddr(it)}" }
+      val sendSats = descriptor.optLong("sendAmountSats", -1L)
+      if (sendSats >= 0) lines += "Amount: ${fmtAmt(sendSats.toDouble() / 1e8)} BCH"
+      descriptor.optString("changeAddress").takeIf { it.isNotEmpty() }?.let { lines += "Change to: ${fmtAddr(it)}" }
+      val spb = descriptor.optInt("satsPerByte", -1)
+      if (spb >= 0) lines += "Fee rate: $spb sat/vB"
+      @Suppress("UNCHECKED_CAST")
+      val inputTotal = (unsignedTx["inputs"] as? List<Map<String, Any>>)
+        ?.mapNotNull { (it["amountSats"] as? String)?.toLongOrNull() }
+        ?.fold(0L, Long::plus) ?: descriptor.optLong("inputTotalSats", 0L)
+      val changeSats = descriptor.optLong("changeAmountSats", 0L)
+      val totalFee = inputTotal - sendSats.coerceAtLeast(0L) - changeSats
+      if (totalFee > 0) lines += "Total fee: ${fmtAmt(totalFee.toDouble() / 1e8)} BCH"
+    }
+    ChainKey.COSMOS -> {
+      (unsignedTx["toAddress"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
+      (unsignedTx["amount"] as? String)?.toLongOrNull()?.let {
+        lines += "Amount: ${fmtAmt(it.toDouble() / 1_000_000.0)} ATOM"
+      }
+      (unsignedTx["feeAmount"] as? String)?.toLongOrNull()?.let {
+        lines += "Fee: ${fmtAmt(it.toDouble() / 1_000_000.0)} ATOM"
+      }
+    }
+    ChainKey.APTOS -> {
+      (unsignedTx["toAddress"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
+      (unsignedTx["amount"] as? String)?.toLongOrNull()?.let {
+        lines += "Amount: ${fmtAmt(it.toDouble() / 1e8)} APT"
+      }
+      val maxGas = (unsignedTx["maxGasAmount"] as? Number)?.toLong()
+      val gasPrice = (unsignedTx["gasUnitPrice"] as? Number)?.toLong()
+      if (maxGas != null && gasPrice != null) {
+        lines += "Max fee: ${fmtAmt((maxGas * gasPrice).toDouble() / 1e8)} APT"
+      }
+    }
+    ChainKey.TEZOS -> {
+      (unsignedTx["toAddress"] as? String)?.let { lines += "To: ${fmtAddr(it)}" }
+      (unsignedTx["amount"] as? Number)?.toLong()?.let {
+        lines += "Amount: ${fmtAmt(it.toDouble() / 1_000_000.0)} XTZ"
+      }
+      (unsignedTx["fee"] as? Number)?.toLong()?.let {
+        lines += "Fee: ${fmtAmt(it.toDouble() / 1_000_000.0)} XTZ"
+      }
+      if (unsignedTx["needsReveal"] == true) lines += "(includes reveal operation)"
     }
   }
   return lines.joinToString("\n")
 }
 
+private data class SolanaSummary(
+  val to: String?,
+  val lamports: ULong?,
+  val isTransfer: Boolean,
+  val splDest: String?,
+  val splAmount: ULong?,
+  val isSplTransfer: Boolean
+)
+
+private fun decodeSolanaForSummary(b64: String): SolanaSummary? {
+  return try {
+    val txBytes = android.util.Base64.decode(b64, android.util.Base64.DEFAULT)
+    val decoded = Solana.DecodingTransactionOutput.parseFrom(TransactionDecoder.decode(CoinType.SOLANA, txBytes))
+    if (decoded.error != Common.SigningError.OK) return null
+    val accounts = decoded.transaction.legacy.accountKeysList
+    val systemProgram = "11111111111111111111111111111111"
+    val splPrograms = setOf(
+      "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",
+      "TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb"
+    )
+
+    var systemIx: Solana.RawMessage.Instruction? = null
+    var splIx: Solana.RawMessage.Instruction? = null
+    for (instr in decoded.transaction.legacy.instructionsList) {
+      val prog = accounts.getOrNull(instr.programId)
+      if (systemIx == null && prog == systemProgram) systemIx = instr
+      if (splIx == null && prog != null && prog in splPrograms) splIx = instr
+    }
+
+    if (systemIx != null) {
+      val ix = systemIx
+      val to = if (ix.accountsCount >= 2) accounts.getOrNull(ix.accountsList[1]) else null
+      val dataBytes = ix.programData.toByteArray()
+      // SystemProgram Transfer discriminator: [2, 0, 0, 0] as u32-LE
+      val isTransfer = dataBytes.size >= 12 &&
+        dataBytes[0] == 2.toByte() && dataBytes[1] == 0.toByte() &&
+        dataBytes[2] == 0.toByte() && dataBytes[3] == 0.toByte()
+      val lamports = if (isTransfer) {
+        var v = 0UL
+        for (i in 0..7) v = v or (dataBytes[4 + i].toUByte().toULong() shl (i * 8))
+        v
+      } else null
+      return SolanaSummary(to, lamports, isTransfer, null, null, false)
+    }
+
+    if (splIx != null) {
+      val ix = splIx
+      val dataBytes = ix.programData.toByteArray()
+      // SPL instruction byte 0: 3 = Transfer, 12 = TransferChecked
+      // Transfer: accounts[0]=src, [1]=dest, [2]=owner; data[1..8]=amount LE u64
+      // TransferChecked: accounts[0]=src, [1]=mint, [2]=dest, [3]=owner
+      return when {
+        dataBytes.isNotEmpty() && dataBytes[0] == 3.toByte() && dataBytes.size >= 9 -> {
+          val dest = if (ix.accountsCount >= 2) accounts.getOrNull(ix.accountsList[1]) else null
+          var amount = 0UL
+          for (i in 0..7) amount = amount or (dataBytes[1 + i].toUByte().toULong() shl (i * 8))
+          SolanaSummary(null, null, false, dest, amount, true)
+        }
+        dataBytes.isNotEmpty() && dataBytes[0] == 12.toByte() && dataBytes.size >= 10 -> {
+          val dest = if (ix.accountsCount >= 3) accounts.getOrNull(ix.accountsList[2]) else null
+          var amount = 0UL
+          for (i in 0..7) amount = amount or (dataBytes[1 + i].toUByte().toULong() shl (i * 8))
+          SolanaSummary(null, null, false, dest, amount, true)
+        }
+        else -> SolanaSummary(null, null, false, null, null, false)
+      }
+    }
+
+    null
+  } catch (_: Exception) {
+    null
+  }
+}
+
 private fun txHexToDouble(hex: String): Double = try {
   BigInteger(hex.removePrefix("0x").ifEmpty { "0" }, 16).toDouble()
-} catch (_: NumberFormatException) { 0.0 }
+} catch (_: NumberFormatException) {
+  0.0
+}
 
 private fun fmtAmt(value: Double): String =
   "%.8f".format(value).trimEnd('0').trimEnd('.')