Ledger Fixes Ethereum App Bug That Let Malicious DApps Sign Different Transactions

Ledger has patched an Ethereum app bug that could have allowed malicious dApps to sign transactions different from those displayed on the device.

The flaw, discovered by security company TestMachine, involved a dApp with WebHID access starting a second signing command while a transaction was still under review, allowing it to replace the transaction held in memory without opening a new review.

Ledger's code history shows two official fix commits that added state checks and refused new signing sessions during active reviews. The patch, version 1.22.2, closes this documented path by refusing a new signing session during an active review and rejecting an approval callback when the state no longer matches.

Ledger's CTO Charles Guillemet said that Ledger Donjon had found the bug before TestMachine contacted Ledger's bounty program, while TestMachine asserted that its Azimuth system found the issue and shared it with Ledger. The public validation of the alleged substitution path is limited to Ledger Flex.