Crypto
Home›Crypto›Ethereum›Ledger pushes Ethereum app update to fix two remaining…
Ledger pushes Ethereum app update to fix two remaining signing flaws
The update, Ethereum app version 1.22.3 released Aug. 25, addresses a case where a 257-operation array could display only the last operation and a swap approval flaw tied to Ledger’s Exchange app.
Ledger has urged users of its Ethereum app to update again after identifying two signing vulnerabilities that persisted in the prior release. The company published Ethereum app version 1.22.3 on Aug. 25, saying it closes weaknesses that could conceal operations from a device review and could authorize a token approval instead of an expected payment.
CryptoSlate reports that Ledger said the earlier controversy involved a separate signing flaw reproduced by rival wallet maker OneKey, tracked as LSB-023. Ledger said no Ledger users were hacked, describing OneKey’s demonstration as a laboratory reproduction on outdated software, and said it found no evidence of exploitation in the wild.
Ledger said version 1.22.2 did not close every known Ethereum app vulnerability, leaving LSB-024 and LSB-025 until version 1.22.3. LSB-024 related to how the app processed arrays of operations during clear signing, where an array containing 257 operations could wrap a counter and cause the device to display only the final operation even though the signature covered the whole batch, a scenario Ledger said required a compromised host and an unusually large attacker-controlled array.
The second issue, LSB-025, affected the token-payment path used by Ledger’s Exchange application during swaps. Ledger said the app checked the token, quantity, and destination, but did not verify that the requested action was actually a payment, allowing a malicious or compromised swap provider to substitute a token approval that matched those parameters and get it signed without an additional device prompt, though Ledger said the flaw could not create unlimited approvals or move funds without a subsequent transaction.
Latest closeEthereum $2,423.87 ▼3.5%