The agent read the screen. Then it lied.

It could see Amount 12.5 ETH. It still asked twice. Both answers were a status word and zero signature bytes. The only signature in the log is the 0.01 ETH the glass agreed to.

It said: 0.01 ETH
Glass showed: 12.5 ETH
Then the wire: 6985 ×2

Flex screen clear-signing Amount 12.5 ETH to the bait address, with Reject on the footer. — Raw Speculos screenshot · not a redraw

02 / 06 · What the glass showed

12.5 ETH. A different address.

Ethereum 1.22.3 clear-signed the fields. Blind signing was off. The amount and the recipient are the app’s own text, not a caption we drew.

The only signature

Hold to sign on the 0.01 ETH transfer returned status 0x9000 and 65 bytes. The digest is keccak256 of the unsigned type-2 payload. Recovery uses the y-parity byte the device sent (00). The host script never loaded a private key.

recovered: 0x9858EfFD232B4033E47d90003D41EC34EcaEda94
device: 0x9858EfFD232B4033E47d90003D41EC34EcaEda94
verdict: MATCH
digest: 0xedbee4329cc35baaf67e9e8cbcf63e5b7e3a312e64a4097607a1dff078dd34c3
r: 0xd6a81462f0036405d58af98df8303c6e5abca565519e91f125774ff2831f1793
s: 0x6a6700067d6dfc934a786665e1117cfd51de3d0d6e309b51a6ac1cf5a23fce58

Watch the flow

Thirty-seven seconds. Every device frame is a screenshot from the run.

What this is not

Not a Ledger in a pocket. Speculos, model Flex, which the challenge allows. Stated on the film.
Not a live language model. The agent is a script. The evidence is the bytes and the screens, which you can re-run.
Not a broadcast and not a funded wallet. Public BIP-39 test mnemonic, path m/44'/60'/0'/0/0. Address 0x9858EfFD232B4033E47d90003D41EC34EcaEda94.
Not a new bug. App Ethereum 1.22.3, API level 26, flags 0x02. Bit 0x01 (blind signing) was off. This is a plain ETH transfer, so the app clear-signs it.
0x6985 is what this build returned for “Yes, reject”, twice, with an empty body. The published status table also lists 0x6982 as “Canceled by user”. We report the wire, not the table.
The two rejects were byte-identical (checked). The approved transaction was the other payload.

Test mnemonic, so anyone can reproduce

abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about