Any command that takes a positional name typed as UnresolvedMuxedAccount (e.g. keys fund, keys public-key / keys address, tx sign, contract invoke --source-account) silently accepts ledger or ledger:N and routes the call to a connected hardware Ledger device.
This shorthand has never been documented — it doesn't appear in any --help text, FULL_HELP_DOCS.md, the README, or any CLI example. The only places it shows up are the parser (parse_ledger in cmd/soroban-cli/src/config/address.rs) and the matching Display impl that prints ledger:N. It was introduced on 2025-02-14 in #1627 ("Feat: add stellar ledger as signer") and has been live since.
With #2557 introducing an explicit --ledger flag (starting on keys address, with other commands to follow), the positional shorthand becomes a confusing and undocumented second way to reach the device — and one that can't be scoped per-command.
Proposed fix
Remove the shorthand entirely:
- Drop the
if value.starts_with("ledger") branch from UnresolvedMuxedAccount::FromStr in cmd/soroban-cli/src/config/address.rs.
- Delete
parse_ledger.
- The
UnresolvedMuxedAccount::Ledger(u32) variant is still constructed by the new --ledger flag in keys address. Either keep it as an internally-constructible variant (simplest), or refactor the flag path to call ledger::new(index) directly and drop the variant entirely.
After the change, the only way to reach a Ledger device for address derivation is the explicit --ledger flag on commands that opt in.
Out of scope
--sign-with-ledger (the existing signing flag) stays as-is.
Any command that takes a positional name typed as
UnresolvedMuxedAccount(e.g.keys fund,keys public-key/keys address,tx sign,contract invoke --source-account) silently acceptsledgerorledger:Nand routes the call to a connected hardware Ledger device.This shorthand has never been documented — it doesn't appear in any
--helptext,FULL_HELP_DOCS.md, the README, or any CLI example. The only places it shows up are the parser (parse_ledgerincmd/soroban-cli/src/config/address.rs) and the matchingDisplayimpl that printsledger:N. It was introduced on 2025-02-14 in #1627 ("Feat: add stellar ledger as signer") and has been live since.With #2557 introducing an explicit
--ledgerflag (starting onkeys address, with other commands to follow), the positional shorthand becomes a confusing and undocumented second way to reach the device — and one that can't be scoped per-command.Proposed fix
Remove the shorthand entirely:
if value.starts_with("ledger")branch fromUnresolvedMuxedAccount::FromStrincmd/soroban-cli/src/config/address.rs.parse_ledger.UnresolvedMuxedAccount::Ledger(u32)variant is still constructed by the new--ledgerflag inkeys address. Either keep it as an internally-constructible variant (simplest), or refactor the flag path to callledger::new(index)directly and drop the variant entirely.After the change, the only way to reach a Ledger device for address derivation is the explicit
--ledgerflag on commands that opt in.Out of scope
--sign-with-ledger(the existing signing flag) stays as-is.