Ledger Claims Ethereum App Flaw Has Been Fixed

Ledger has refuted TestMachine's claims regarding a security flaw in its Ethereum app, stating that the issue has been resolved. Ledger's CTO, Charles Guillemet, announced that 'Security issues' were fixed in the Ethereum app version 1.22.2 released on August 12. The previous version, 1.22.0, included the addition of 'Clear-signing gating support.' The controversy began over the potential discrepancy between the transaction details displayed by the hardware wallet and the actual signing target. Ledger distinguishes between 'Clear Signing' and 'Blind Signing,' warning that signatures without the ability to verify transaction details are risky. TestMachine claimed to have discovered the issue using its tool, Azimuth, but Ledger has not officially confirmed the extent of the impact. Guillemet criticized TestMachine for contacting them after the fix was deployed, suggesting that the public thread made it appear as though the issue was unresolved. Ledger emphasized that its bug bounty policy requires coordination of vulnerability reporting, reproduction verification, fix deployment, and public disclosure. So far, there have been no confirmed cases of funds being stolen due to this flaw.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.