diff --git a/crates/xrpl-host-functions/src/lib.rs b/crates/xrpl-host-functions/src/lib.rs
index e317316cbb..c714f447c3 100644
--- a/crates/xrpl-host-functions/src/lib.rs
+++ b/crates/xrpl-host-functions/src/lib.rs
@@ -152,6 +152,13 @@ host_functions! {
     #[wasm_name = "le_field"]
     fn get_ledger_obj_field(&self, cache_idx: i32, field: i32, out: &mut [u8]) -> HostResult<usize>;
 
+    /// The serialized bytes of a nested field of the transaction, reached by a
+    /// `locator`: a path of little-endian `i32` steps (so its byte length is a
+    /// non-zero multiple of 4). Reads the locator region and writes the field bytes.
+    #[gas = 110]
+    #[wasm_name = "tx_inner"]
+    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize>;
+
     /// The XRPL `sha512Half` of `data`: the first [`HASH_LEN`] bytes of its SHA-512.
     #[gas = 2000]
     #[wasm_name = "sha512_half"]
diff --git a/crates/xrpl-host-functions/tests/generated_abi.rs b/crates/xrpl-host-functions/tests/generated_abi.rs
index 2361325d2f..21839c05b5 100644
--- a/crates/xrpl-host-functions/tests/generated_abi.rs
+++ b/crates/xrpl-host-functions/tests/generated_abi.rs
@@ -82,6 +82,14 @@ impl HostFunctions for FakeHost {
         put(out, &[cache_idx as u8, field as u8])
     }
 
+    /// A nested-field getter over the transaction, keyed by the locator bytes.
+    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize> {
+        if locator.is_empty() {
+            return Err(HostError::LocatorMalformed);
+        }
+        put(out, &[locator[0], locator.len() as u8])
+    }
+
     fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize> {
         let mut digest = [0; HASH_LEN];
         digest[0] = data.len() as u8;
@@ -124,6 +132,8 @@ fn the_trait_is_implementable() {
     assert_eq!(out[0], 3);
     assert_eq!(host.get_ledger_obj_field(2, 4, &mut out), Ok(2));
     assert_eq!(out[..2], [2, 4]);
+    assert_eq!(host.get_tx_nested_field(&[9, 0, 0, 0], &mut out), Ok(2));
+    assert_eq!(out[..2], [9, 4]);
     assert_eq!(host.sha512_half(b"abc", &mut out), Ok(HASH_LEN));
     assert_eq!(out[0], 3);
     assert_eq!(host.trace("hello", b"xy", true), Ok(()));
@@ -200,6 +210,7 @@ fn the_spec_table_matches_the_declarations() {
             ("tx_field", 70),
             ("home_le_field", 70),
             ("le_field", 70),
+            ("tx_inner", 110),
             ("sha512_half", 2000),
             ("trace", 500),
             ("trace_num", 500),
diff --git a/crates/xrpl-wasm-vm-ffi/src/lib.rs b/crates/xrpl-wasm-vm-ffi/src/lib.rs
index c9402426b9..9d68635395 100644
--- a/crates/xrpl-wasm-vm-ffi/src/lib.rs
+++ b/crates/xrpl-wasm-vm-ffi/src/lib.rs
@@ -200,6 +200,10 @@ mod ffi {
             out: &mut [u8],
         ) -> i32;
 
+        #[namespace = "xrpl"]
+        #[cxx_name = "getTxNestedField"]
+        fn get_tx_nested_field(self: &HostContext, locator: &[u8], out: &mut [u8]) -> i32;
+
         #[namespace = "xrpl"]
         #[cxx_name = "sha512Half"]
         fn sha512_half(self: &HostContext, data: &[u8], out: &mut [u8]) -> i32;
@@ -295,6 +299,10 @@ impl HostFunctions for CxxHost<'_> {
         bytes_written(self.ctx.get_ledger_obj_field(cache_idx, field, out))
     }
 
+    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize> {
+        bytes_written(self.ctx.get_tx_nested_field(locator, out))
+    }
+
     fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize> {
         bytes_written(self.ctx.sha512_half(data, out))
     }
diff --git a/crates/xrpl-wasm-vm/src/abi.rs b/crates/xrpl-wasm-vm/src/abi.rs
index b3f5eb7c44..ed159d4c5a 100644
--- a/crates/xrpl-wasm-vm/src/abi.rs
+++ b/crates/xrpl-wasm-vm/src/abi.rs
@@ -217,6 +217,9 @@ mod tests {
         ) -> HostResult<usize> {
             unreachable!("no unit test in this module calls the host")
         }
+        fn get_tx_nested_field(&self, _locator: &[u8], _out: &mut [u8]) -> HostResult<usize> {
+            unreachable!("no unit test in this module calls the host")
+        }
         fn sha512_half(&self, _data: &[u8], _out: &mut [u8]) -> HostResult<usize> {
             unreachable!("no unit test in this module calls the host")
         }
diff --git a/crates/xrpl-wasm-vm/src/register.rs b/crates/xrpl-wasm-vm/src/register.rs
index ea5ab4aa25..5540360d95 100644
--- a/crates/xrpl-wasm-vm/src/register.rs
+++ b/crates/xrpl-wasm-vm/src/register.rs
@@ -154,6 +154,24 @@ pub(crate) fn register_host_functions(
                     })
                 },
             ),
+            HostFunctionSpec::GetTxNestedField => linker.func_wrap(
+                HOST_MODULE,
+                op.wasm_name(),
+                |mut caller: Caller<'_, VmState<'_>>,
+                 loc_ptr: i32,
+                 loc_len: i32,
+                 out_ptr: i32,
+                 out_len: i32|
+                 -> Result<i32, wasmi::Error> {
+                    charged(&mut caller, HostFunctionSpec::GetTxNestedField, |c| {
+                        let out = Region::new(out_ptr, out_len);
+                        let locator = Region::new(loc_ptr, loc_len);
+                        write_buffered(c, out, |host, data, buf| {
+                            host.get_tx_nested_field(locator.read(data)?, buf)
+                        })
+                    })
+                },
+            ),
             HostFunctionSpec::Sha512Half => linker.func_wrap(
                 HOST_MODULE,
                 op.wasm_name(),
diff --git a/crates/xrpl-wasm-vm/tests/budgets.rs b/crates/xrpl-wasm-vm/tests/budgets.rs
index cbe9439c7f..ad4d4e3abe 100644
--- a/crates/xrpl-wasm-vm/tests/budgets.rs
+++ b/crates/xrpl-wasm-vm/tests/budgets.rs
@@ -96,6 +96,11 @@ fn call_for(op: HostFunctionSpec) -> Call {
             "(call $le_field (i32.const 1) (i32.const 1) (i32.const 0) (i32.const 4))",
             4,
         ),
+        HostFunctionSpec::GetTxNestedField => (
+            import::TX_INNER,
+            "(call $tx_inner (i32.const 0) (i32.const 4) (i32.const 8) (i32.const 4))",
+            4,
+        ),
         HostFunctionSpec::Sha512Half => (
             import::SHA512_HALF,
             "(call $sha512_half (i32.const 0) (i32.const 4) (i32.const 0) (i32.const 32))",
diff --git a/crates/xrpl-wasm-vm/tests/host_calls.rs b/crates/xrpl-wasm-vm/tests/host_calls.rs
index 7d5fe8ab21..5732752cea 100644
--- a/crates/xrpl-wasm-vm/tests/host_calls.rs
+++ b/crates/xrpl-wasm-vm/tests/host_calls.rs
@@ -186,6 +186,26 @@ fn le_field_passes_the_slot_and_selector_through() {
     assert_eq!(*host.le_fields_asked.borrow(), vec![(2, 17)]);
 }
 
+/// A nested-field getter: the locator is read from one region and the answer written
+/// to another — the read-input-write-output path. The guest lays the locator down in
+/// memory, and the bytes the host answers land where it asked.
+#[test]
+fn tx_inner_reads_the_locator_and_writes_the_field() {
+    // An eight-byte, two-step locator, as it lands in little-endian guest memory.
+    let locator = vec![17u8, 0, 0, 0, 2, 0, 0, 0];
+    let host =
+        FakeHost::new().answering_tx_nested(locator.clone(), support::Answer::bytes([0xaa, 0xbb]));
+
+    let wat = module(
+        &[import::TX_INNER, ONE_PAGE],
+        "(i32.store (i32.const 0) (i32.const 17))
+         (i32.store (i32.const 4) (i32.const 2))
+         (call $tx_inner (i32.const 0) (i32.const 8) (i32.const 64) (i32.const 64))",
+    );
+    assert_eq!(status(&wat, &host), 2, "the field bytes the host wrote");
+    assert_eq!(*host.tx_nested_asked.borrow(), vec![locator]);
+}
+
 /// A leading scalar parameter reaches the host as declared.
 #[test]
 fn home_le_field_passes_the_field_selector_through() {
diff --git a/crates/xrpl-wasm-vm/tests/preflight.rs b/crates/xrpl-wasm-vm/tests/preflight.rs
index 9edce35a06..4725baf5bc 100644
--- a/crates/xrpl-wasm-vm/tests/preflight.rs
+++ b/crates/xrpl-wasm-vm/tests/preflight.rs
@@ -98,7 +98,7 @@ fn a_disabled_feature_does_not_pass() {
 
 /// Every host function the ABI declares, spelled as a guest imports it. The count
 /// is asserted against the ABI so a function added to it cannot be left out here.
-const ALL_IMPORTS: [&str; 12] = [
+const ALL_IMPORTS: [&str; 13] = [
     import::LDGR_INDEX,
     import::PARENT_LDGR_TIME,
     import::PARENT_LDGR_HASH,
@@ -108,6 +108,7 @@ const ALL_IMPORTS: [&str; 12] = [
     import::TX_FIELD,
     import::HOME_LE_FIELD,
     import::LE_FIELD,
+    import::TX_INNER,
     import::SHA512_HALF,
     import::TRACE,
     import::TRACE_NUM,
diff --git a/crates/xrpl-wasm-vm/tests/support/mod.rs b/crates/xrpl-wasm-vm/tests/support/mod.rs
index 9822971633..908a965057 100644
--- a/crates/xrpl-wasm-vm/tests/support/mod.rs
+++ b/crates/xrpl-wasm-vm/tests/support/mod.rs
@@ -130,6 +130,11 @@ pub struct FakeHost {
     pub le_fields: HashMap<(i32, i32), Answer>,
     /// Every (cache slot, field selector) `get_ledger_obj_field` was asked for.
     pub le_fields_asked: RefCell<Vec<(i32, i32)>>,
+    /// What `get_tx_nested_field` answers, by locator bytes. An unlisted locator
+    /// answers `FieldNotFound`.
+    pub tx_nested: HashMap<Vec<u8>, Answer>,
+    /// Every locator `get_tx_nested_field` was asked for.
+    pub tx_nested_asked: RefCell<Vec<Vec<u8>>>,
     /// What `sha512_half` answers, whatever it is given.
     pub digest: Answer,
     /// Every field selector `get_current_ledger_obj_field` was asked for.
@@ -163,6 +168,8 @@ impl Default for FakeHost {
             fields: HashMap::new(),
             le_fields: HashMap::new(),
             le_fields_asked: RefCell::new(Vec::new()),
+            tx_nested: HashMap::new(),
+            tx_nested_asked: RefCell::new(Vec::new()),
             digest: Answer::filler(32),
             fields_asked: RefCell::new(Vec::new()),
             digested: RefCell::new(Vec::new()),
@@ -221,6 +228,11 @@ impl FakeHost {
         self
     }
 
+    pub fn answering_tx_nested(mut self, locator: Vec<u8>, answer: Answer) -> FakeHost {
+        self.tx_nested.insert(locator, answer);
+        self
+    }
+
     pub fn answering_digest(mut self, answer: Answer) -> FakeHost {
         self.digest = answer;
         self
@@ -287,6 +299,14 @@ impl HostFunctions for FakeHost {
         }
     }
 
+    fn get_tx_nested_field(&self, locator: &[u8], out: &mut [u8]) -> HostResult<usize> {
+        self.tx_nested_asked.borrow_mut().push(locator.to_vec());
+        match self.tx_nested.get(locator) {
+            Some(answer) => answer.fill(out),
+            None => Err(HostError::FieldNotFound),
+        }
+    }
+
     fn sha512_half(&self, data: &[u8], out: &mut [u8]) -> HostResult<usize> {
         self.digested.borrow_mut().push(data.to_vec());
         self.digest.fill(out)
@@ -332,6 +352,8 @@ pub mod import {
     pub const HOME_LE_FIELD: &str = r#"(import "host_lib" "home_le_field" (func $home_le_field (param i32 i32 i32) (result i32)))"#;
     pub const LE_FIELD: &str =
         r#"(import "host_lib" "le_field" (func $le_field (param i32 i32 i32 i32) (result i32)))"#;
+    pub const TX_INNER: &str =
+        r#"(import "host_lib" "tx_inner" (func $tx_inner (param i32 i32 i32 i32) (result i32)))"#;
     pub const SHA512_HALF: &str = r#"(import "host_lib" "sha512_half" (func $sha512_half (param i32 i32 i32 i32) (result i32)))"#;
     pub const TRACE: &str =
         r#"(import "host_lib" "trace" (func $trace (param i32 i32 i32 i32 i32) (result i32)))"#;
diff --git a/include/xrpl/tx/wasm/HostContext.h b/include/xrpl/tx/wasm/HostContext.h
index a3ec432d6f..6083a93920 100644
--- a/include/xrpl/tx/wasm/HostContext.h
+++ b/include/xrpl/tx/wasm/HostContext.h
@@ -75,6 +75,12 @@ public:
     getLedgerObjField(std::int32_t cacheIdx, std::int32_t field, rust::Slice<std::uint8_t> out)
         const noexcept;
 
+    // The locator is a path of little-endian i32 steps, so its byte length must be a
+    // non-zero multiple of 4, else `LocatorMalformed`.
+    [[nodiscard]] std::int32_t
+    getTxNestedField(rust::Slice<std::uint8_t const> locator, rust::Slice<std::uint8_t> out)
+        const noexcept;
+
     [[nodiscard]] std::int32_t
     sha512Half(rust::Slice<std::uint8_t const> data, rust::Slice<std::uint8_t> out) const noexcept;
 
diff --git a/src/libxrpl/tx/wasm/HostContext.cpp b/src/libxrpl/tx/wasm/HostContext.cpp
index 9003f9e10e..2a1d2f37f4 100644
--- a/src/libxrpl/tx/wasm/HostContext.cpp
+++ b/src/libxrpl/tx/wasm/HostContext.cpp
@@ -12,6 +12,8 @@
 #include <cstdint>
 #include <cstring>
 #include <string_view>
+#include <utility>
+#include <vector>
 
 namespace xrpl {
 
@@ -206,6 +208,32 @@ HostContext::getLedgerObjField(
     });
 }
 
+std::int32_t
+HostContext::getTxNestedField(
+    rust::Slice<std::uint8_t const> locator,
+    rust::Slice<std::uint8_t> out) const noexcept
+{
+    return guarded(hostFunctions_.getJournal(), kHostInternal, [&] {
+        // A path of i32 steps: non-empty and a whole number of them.
+        if (locator.empty() || (locator.size() & 3) != 0)
+            return hfErrorToInt(HostFunctionError::LocatorMalformed);
+
+        // Copy into an aligned int32 buffer rather than aliasing the slice, whose
+        // bytes carry no int32 alignment guarantee. The wire byte order is kept; the
+        // field getters below apply `adjustWasmEndianess` when they read a step.
+        std::uint32_t const steps = locator.size() / sizeof(std::int32_t);
+        std::vector<std::int32_t> locBuf(steps);
+        std::memcpy(locBuf.data(), locator.data(), locator.size());
+        FieldLocator const fl(std::move(locBuf));
+
+        auto const value = hostFunctions_.getTxNestedField(fl);
+        if (!value)
+            return hfErrorToInt(value.error());
+
+        return answer(out, value->data(), value->size());
+    });
+}
+
 std::int32_t
 HostContext::sha512Half(rust::Slice<std::uint8_t const> data, rust::Slice<std::uint8_t> out)
     const noexcept