Are there any third-party tools to verify the BC-UR, V3 QR codes？

[WooolJuuun]

The bc-ur,v3 QR codes generated by the Airgap vault and wallet are encoded with bc-UR. Is there a convenient third-party tool that can decode these QR codes, making the UR-encoded QR codes human-readable so that we can see what information they contain, whether there is any sensitive information such as mnemonic phrases or private keys that should not be transmitted? This is not nitpicking, but rather practicing the motto of "Don't trust, verify."
To the best of my knowledge, there are some hardware wallets that claim they also transmit information through QR codes, but this information is encrypted exclusively by them and cannot be verified by third parties.

[recolic]

I'm working on something similar. This is a POC code.

# doc: https://developer.onekey.so/connect-to-hardware/air-gap-qr-code/reference/ethereum-and-evm/ethsignrequest

from ur.ur_decoder import URDecoder
from ur.ur import UR
import cbor2

def decode_ur(ur_string):
    dec = URDecoder()
    dec.receive_part(ur_string)
    if not dec.is_complete() or not dec.is_success():
        raise ValueError("UR not decoded")
    return dec.result.cbor


def decode_eth_sign_request(ur_string):
    cbor_bytes = decode_ur(ur_string)

    data = cbor2.loads(cbor_bytes)

    # EthSignRequest structure:
    # {
    #   1: requestId (optional)
    #   2: signData
    #   3: dataType
    #   4: chainId (optional)
    #   5: derivationPath (complex object)
    #   6: address (optional)
    #   7: origin (optional)
    # }
    # dataType:
    #    transaction = 1, // For the legacy transaction, the rlp encoding of the unsigned data.
    #    typedData = 2, // For the EIP-712 typed data. Bytes of the json string.
    #    personalMessage = 3, // For the personal message signing.
    #    typedTransaction = 4 // For the typed transaction, like the EIP-1559 transaction.
    sign_data, data_type = data[2], data[3]
    chain_id = data.get(4)
    return sign_data, data_type, chain_id

#from web3 import Web3
#def decode_tx(raw_tx_bytes):
#    w3 = Web3()
#    return w3.eth.account._parse_transaction(raw_tx_bytes)
from eth_account.typed_transactions import TypedTransaction
from eth_account._utils.legacy_transactions import Transaction, vrs_from
from eth_account._utils.signing import hash_of_signed_transaction
from eth_account import Account
import eth_account
from hexbytes import HexBytes
import rlp

def decode_alt(txn_bytes):
    ## weird workaround. why this extra byte in RLP???
    if txn_bytes[0] == 0x02: txn_bytes = txn_bytes[1:]
    # recolic: manually implement ETH sign request parsing
    # [HexBytes('0x89'), HexBytes('0x02'), HexBytes('0x0a7a358200'), HexBytes('0x0df14de102'), HexBytes('0xee72'), HexBytes('0xvery_long_addr'), HexBytes('0x'), HexBytes('<very long data>'), []]
    chain_id, tx_type, max_priority_fee_pg, max_fee_pg, gas_limit, tx_to, tx_amount, tx_data, access_list = rlp.decode(txn_bytes)
    def chain_name(cid):
        m = {1:"ETH",137:"Polygon",56:"BNB",10:"Optimism",42161:"Arbitrum"}
        return m.get(int.from_bytes(cid,'big'),"Unknown")
    def tx_type_name(t):
        return "EIP-1559" if int.from_bytes(t,'big') == 2 else "Unknown"
    def hx(x):
        return x.hex() if x else "0x"
    cid = int.from_bytes(chain_id,'big')
    tf = int.from_bytes(max_fee_pg,'big')
    gl = int.from_bytes(gas_limit,'big')
    amt = int.from_bytes(tx_amount,'big') if tx_amount else 0
    
    print("Chain:", cid, chain_name(chain_id))
    print("Type:", tx_type_name(tx_type))
    print("Max total fee:", format((tf*gl)/1e18, ".8f"), "ETH")
    print("To:", hx(tx_to))
    print("Amount:", amt)
    print("Data:", hx(tx_data))

def decode_tx(raw_bytes, data_type):
    # Ref: https://ethereum.stackexchange.com/questions/83802/how-to-decode-a-raw-transaction-in-python
    txn_bytes = HexBytes(raw_bytes)
    print("tx bytes:", txn_bytes.hex())
    if data_type == 4:
        # We are dealing with a typed transaction.
        tx_type = 2
        decode_alt(txn_bytes)
        exit() # for known reason, next line will crash
        tx = TypedTransaction.from_bytes(txn_bytes)
        #tx=eth_account._utils.signing.UnsignedTransaction.from_bytes(txn_bytes)
        msg_hash = tx.hash()
        vrs = tx.vrs()
    else:
        # We are dealing with a legacy transaction.
        tx_type = 0
        tx = Transaction.from_bytes(txn_bytes)
        msg_hash = hash_of_signed_transaction(tx)
        vrs = vrs_from(tx)

    # extracting sender address
    sender = Account._recover_hash(msg_hash, vrs=vrs)

    # adding sender to result and cleaning
    res = tx.as_dict()
    res["from"] = sender
    res["to"] = res["to"].hex()
    res["data"] = res["data"].hex()
    res["type"] = res.get("type", tx_type)

    return res


# ------------ FULL PIPELINE ------------

def parse_eth_sign_request(ur_string):
    sign_data, t, chain_id = decode_eth_sign_request(ur_string)
    tx = decode_tx(sign_data, t)
    return {
        "chain_id": chain_id,
        "tx": tx,
    }


# ------------ RUN ON YOUR SAMPLE ------------

qr = "ur:eth-sign-request/oladtpdagdpyjzbsveemamfpfllnsogydrolcssocmaohdjpaoyajllyldaolpbkkneclfaelpbtwngtvyaolfwyjpmwfngansghdwwshyetbyvycfdwvdbtlkrtfshheohklarofyptahnsrkaeaeaeaeaeaeaeaeaeaeaeaehehgwemthgaewmlnmusewpwtqdisclbzmundpazeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaeaebsfwfzrtaxaaaacsldahtaaddyoeadlecsdwykcsfnykaeykaewkaewkaocybnmdbbsnamghhehgwemthgaewmlnmusewpwtqdisclbzmundpazebkhytyjs"

result = parse_eth_sign_request(qr)
print(result)

If you want to do typescript, keystone HQ has their official typescript library. The QR code is just:

bc-ur encoded cbor2 encoded ETH transaction

[recolic]

Also ref this and this document from keystone:

https://github.com/KeystoneHQ/Keystone-developer-hub/blob/main/integration/ethereum.md

https://developer.onekey.so/connect-to-hardware/air-gap-qr-code/reference/ethereum-and-evm/ethsignrequest