fix(tron): Enhance Tron direct transaction signing and address security issues

android/app/src/androidTest/java/com/trustwallet/core/app/blockchains/tron/TestTronTransactionSigner.kt

@@ -17,18 +17,6 @@ class TestTronTransactionSigner {
         System.loadLibrary("TrustWalletCore")
     }
 
-    @Test
-    fun testSignDirect() {
-        val signingInput = Tron.SigningInput.newBuilder()
-            .setTxId("546a3d07164c624809cf4e564a083a7a7974bb3c4eff6bb3e278b0ca21083fcb")
-            .setPrivateKey(ByteString.copyFrom("2d8f68944bdbfbc0769542fba8fc2d2a3de67393334471624364c7006da2aa54".toHexByteArray()))
-
-        val output = AnySigner.sign(signingInput.build(), TRON, Tron.SigningOutput.parser())
-
-        assertEquals(Numeric.toHexString(output.id.toByteArray()), "0x546a3d07164c624809cf4e564a083a7a7974bb3c4eff6bb3e278b0ca21083fcb")
-        assertEquals(Numeric.toHexString(output.signature.toByteArray()), "0x77f5eabde31e739d34a66914540f1756981dc7d782c9656f5e14e53b59a15371603a183aa12124adeee7991bf55acc8e488a6ca04fb393b1a8ac16610eeafdfc00")
-    }
-
     @Test
     fun testSignTransferTrc20Contract() {
         val trc20Contract = Tron.TransferTRC20Contract.newBuilder()
@@ -62,4 +50,20 @@ class TestTronTransactionSigner {
         assertEquals(Numeric.toHexString(output.id.toByteArray()), "0x0d644290e3cf554f6219c7747f5287589b6e7e30e1b02793b48ba362da6a5058")
         assertEquals(Numeric.toHexString(output.signature.toByteArray()), "0xbec790877b3a008640781e3948b070740b1f6023c29ecb3f7b5835433c13fc5835e5cad3bd44360ff2ddad5ed7dc9d7dee6878f90e86a40355b7697f5954b88c01")
     }
+
+    @Test
+    fun testSignRawJsonTransferContract() {
+        val rawJson = """
+            {"raw_data":{"contract":[{"parameter":{"type_url":"type.googleapis.com/protocol.TransferContract","value":{"amount":2000000,"owner_address":"415cd0fb0ab3ce40f3051414c604b27756e69e43db","to_address":"41521ea197907927725ef36d70f25f850d1659c7c7"}},"type":"TransferContract"}],"expiration":1539331479000,"ref_block_bytes":"7b3b","ref_block_hash":"b21ace8d6ac20e7e","timestamp":1539295479000},"raw_data_hex":"0a027b3b2208b21ace8d6ac20e7e40d8abb9bae62c5a67080112630a2d747970652e676f6f676c65617069732e636f6d2f70726f746f636f6c2e5472616e73666572436f6e747261637412320a15415cd0fb0ab3ce40f3051414c604b27756e69e43db121541521ea197907927725ef36d70f25f850d1659c7c71880897a70d889a4a9e62c","txID":"dc6f6d9325ee44ab3c00528472be16e1572ab076aa161ccd12515029869d0451"}
+        """.trimIndent()
+
+        val signingInput = Tron.SigningInput.newBuilder()
+            .setRawJson(rawJson)
+            .setPrivateKey(ByteString.copyFrom("2d8f68944bdbfbc0769542fba8fc2d2a3de67393334471624364c7006da2aa54".toHexByteArray()))
+
+        val output = AnySigner.sign(signingInput.build(), TRON, Tron.SigningOutput.parser())
+
+        assertEquals(Numeric.toHexString(output.id.toByteArray()), "0xdc6f6d9325ee44ab3c00528472be16e1572ab076aa161ccd12515029869d0451")
+        assertEquals(Numeric.toHexString(output.signature.toByteArray()), "0xede769f6df28aefe6a846be169958c155e23e7e5c9621d2e8dce1719b4d952b63e8a8bf9f00e41204ac1bf69b1a663dacdf764367e48e4a5afcd6b055a747fb200")
+    }
 }

rust/tw_proto/src/impls.rs

@@ -35,6 +35,7 @@ impl fmt::Display for SigningError {
             SigningError::Error_invalid_requested_token_amount => "Invalid input token amount",
             SigningError::Error_not_supported => "Operation not supported for the chain",
             SigningError::Error_dust_amount_requested => "Requested amount is too low (less dust)",
+            SigningError::Error_tx_hash_mismatch => "The transaction hash does not match the hash derived from the raw transaction data"
         };
         write!(f, "{err}")
     }

src/Tron/Constants.h

@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Copyright © 2017 Trust Wallet.
+
+#pragma once
+
+namespace TW::Tron {
+
+// ---------------------------------------------------------------------------
+// JSON field name constants
+// ---------------------------------------------------------------------------
+
+// Top-level transaction fields
+static constexpr auto kFieldTypeUrlPrefix      = "type.googleapis.com";
+static constexpr auto kFieldRawData            = "raw_data";
+static constexpr auto kFieldSignature          = "signature";
+static constexpr auto kFieldTxID               = "txID";
+static constexpr auto kFieldRawDataHex         = "raw_data_hex";
+
+// Contract wrapper fields
+static constexpr auto kFieldType               = "type";
+static constexpr auto kFieldParameter          = "parameter";
+static constexpr auto kFieldProvider           = "provider";
+static constexpr auto kFieldValue              = "value";
+static constexpr auto kFieldTypeUrl            = "type_url";
+static constexpr auto kFieldContract           = "contract";
+static constexpr auto kFieldContractName       = "ContractName";
+static constexpr auto kFieldPermId             = "Permission_id";
+
+// raw_data fields
+static constexpr auto kFieldRefBlockBytes      = "ref_block_bytes";
+static constexpr auto kFieldRefBlockHash       = "ref_block_hash";
+static constexpr auto kFieldRefBlockNum        = "ref_block_num";
+static constexpr auto kFieldTimestamp          = "timestamp";
+static constexpr auto kFieldExpiration         = "expiration";
+static constexpr auto kFieldFeeLimit           = "fee_limit";
+static constexpr auto kFieldData               = "data";
+
+// Contract value fields — common
+static constexpr auto kFieldOwnerAddress       = "owner_address";
+static constexpr auto kFieldToAddress          = "to_address";
+static constexpr auto kFieldAmount             = "amount";
+static constexpr auto kFieldResource           = "resource";
+static constexpr auto kFieldReceiverAddress    = "receiver_address";
+static constexpr auto kFieldBalance            = "balance";
+
+// TransferAssetContract
+static constexpr auto kFieldAssetName          = "asset_name";
+
+// VoteAssetContract
+static constexpr auto kFieldVoteAddress        = "vote_address";
+static constexpr auto kFieldSupport            = "support";
+static constexpr auto kFieldCount              = "count";
+
+// VoteWitnessContract
+static constexpr auto kFieldVotes              = "votes";
+static constexpr auto kFieldVoteCount          = "vote_count";
+
+// FreezeBalanceContract
+static constexpr auto kFieldFrozenBalance      = "frozen_balance";
+static constexpr auto kFieldFrozenDuration     = "frozen_duration";
+
+// UnfreezeBalanceV2Contract
+static constexpr auto kFieldUnfreezeBalance    = "unfreeze_balance";
+
+// DelegateResourceContract
+static constexpr auto kFieldLock               = "lock";
+static constexpr auto kFieldLockPeriod         = "lock_period";
+
+// TriggerSmartContract
+static constexpr auto kFieldContractAddress    = "contract_address";
+static constexpr auto kFieldCallValue          = "call_value";
+static constexpr auto kFieldCallTokenValue     = "call_token_value";
+static constexpr auto kFieldTokenId            = "token_id";
+
+} // namespace TW::Tron
+