Crypto
Home›Crypto›Market Structure›Ledger patches Ethereum app bug tied to double signing…
Ledger patches Ethereum app bug tied to double signing flow
The company said the update stops a new signing session during an active review, and rejects approval callbacks when the app state no longer matches.
Ledger is urging users to update its Ethereum app to version 1.22.2 after code changes aimed at preventing an attack scenario where a device could sign substituted data while showing one transaction for approval. CryptoSlate reports that the issue involves malicious software or a connected host starting a second signing command before the first transaction review completes.
According to CryptoSlate, the attack path described by security company TestMachine required a dApp with WebHID access. TestMachine said an attacker could replace the transaction held in memory without opening a new review, leaving the original details on screen while the device signed the replacement.
CryptoSlate also notes that Ledger’s development history points to fixes for signing-state handling, including a change that can tear down an active review and return an error, plus added state checks so approval callbacks only succeed when the device remains in the expected signing state. In Ledger’s version 1.22.2, the app refuses a new signing session during an active review and rejects approval callbacks when the state no longer matches.
CryptoSlate adds that TestMachine asserted the shared code extended the problem to several models listed as build targets in the app manifest, including Nano X, Nano S Plus, Stax, and Apex, alongside Flex. Ledger’s CTO, Charles Guillemet, said Ledger Donjon identified and deployed the fix about two weeks earlier than TestMachine’s public disclosure, and users are advised to confirm Ethereum app 1.22.2 is installed while keeping firmware and software current.
Latest closeEthereum $2,507.52 ▲1.8%