Ledger Patched a Flaw That Could Have Made Its Ethereum App Sign a Transaction Different From the One Displayed

Ledger fixed a defect in the Ethereum application on its hardware wallets that could allow a malicious website to substitute transaction data while a user was reviewing a payment on the device screen. CryptoSlate reports that version 1.22.2 adds two signing-state safeguards, rejecting signature commands that arrive while a review is still open and fixing the signing mode at the start of an operation. The reported attack path is a race between commands sent to the device over a browser connection, which is why the flaw affected the clear-signing flow, the feature marketed precisely to stop users approving contents they cannot read.

The two sides tell different stories about discovery. Ledger's chief technology officer, Charles Guillemet, said the company's internal Donjon security team found the bug with an artificial-intelligence vulnerability research system and shipped the fix before the public warning, and he characterized the disclosure as manufacturing fear for attention. The researchers operating as TestMachine say their own automated system found the issue and that they shared and verified it with Ledger. No reports of lost funds have surfaced. CryptoSlate notes that public physical validation of the substitution path is limited to one device model, the Ledger Flex, so the real-world reach across the product line is documented less thoroughly than the patch is.

Both accounts point to the same underlying condition. Automated code analysis is now finding implementation faults in signing firmware faster than the disclosure norms of the industry can absorb them, and the argument moves to timing and credit rather than to whether the defect was real.

The engineering response elsewhere is to remove the attack surface rather than try to manage it after the fact. Blockstream shipped desktop version 3.5.0 of its application with fully air-gapped signing for its Jade device over scanned codes, alongside Lightning payments in beta. A signer with no live data connection to the host computer cannot lose a race with commands sent by that computer.