Ethereum App Bug Patched After Malicious Signatures Discovered

Ledger's Ethereum app has been patched after security researchers found a bug that could allow malicious dApps to trick users into signing one transaction while reviewing another.

According to TestMachine, an attacker would need a dApp with WebHID access to exploit the issue. The group said that pressing 'approve' on the device could return a signature for substituted data instead of the original transaction being reviewed.

The bug was discovered in Ledger's code history and has been fixed in version 1.22.2. This patch prevents new signing sessions during active reviews and rejects approval callbacks when the state no longer matches.

Ledger CTO Charles Guillemet said that Ledger Donjon had found the bug before TestMachine contacted the company's bounty program. The fix was deployed about two weeks earlier than the public release, but it wasn't yet available to users at the time of TestMachine's discovery.