{"id":12508,"date":"2026-08-28T12:29:12","date_gmt":"2026-08-28T12:29:12","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=12508"},"modified":"2026-08-28T12:29:12","modified_gmt":"2026-08-28T12:29:12","slug":"ledger-patched-critical-signing-bugs-months-after-writing-the-fixes","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=12508","title":{"rendered":"Ledger patched critical signing bugs months after writing the fixes"},"content":{"rendered":"

<\/p>\n

\n

Crypto wallet maker Ledger is urging its Ethereum app users to update again after two signing flaws remained in its previous security release.<\/p>\n

The hardware-wallet maker published Ethereum app version 1.22.3 on Aug. 25, closing vulnerabilities that could hide operations from a device review or authorize a token approval in place of an expected payment.<\/p>\n

The update follows controversy over a separate Ethereum signing flaw reproduced by rival wallet maker OneKey. That issue, tracked as LSB-023, affected older versions and allowed a compromised host to interleave commands so that transaction parameters could change after being displayed but before signing.<\/p>\n

Ledger said OneKey demonstrated the bug against version 1.22.1 after the company had already fixed it in Ethereum app 1.22.2, released Aug. 13.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Ledger patched an Ethereum app bug that could show one transaction and sign another<\/h3>\n<\/p>\n

<\/span> <\/div>\n

\u201cNo Ledger user was hacked,\u201d Ledger\u2019s security team said, describing the demonstration as a laboratory reproduction involving outdated software. The company said it had found no evidence of exploitation in the wild.<\/p>\n

Ledger Chief Technology Officer Charles Guillemet made the same distinction, saying reproducing an already-patched flaw did not amount to \u201chacking Ledger.\u201d<\/p>\n

Version 1.22.2, however, did not close every known Ethereum-app vulnerability on Ledger. Instead, two separate flaws, LSB-024 and LSB-025, remained until the release of 1.22.3.<\/p>\n

Two additional signing paths remained exposed<\/h2>\n

LSB-024 affected how the Ethereum app processed arrays of operations during clear signing.<\/p>\n

The app read the number of operations using a 16-bit value but stored the remaining count in an 8-bit field. In Ledger\u2019s proof of concept, an array containing 257 operations wrapped the counter back to one, causing the device to display only the final operation even though its signature authorized the entire batch.<\/p>\n

Exploitation required a compromised host and an unusually large attacker-controlled operation array. Ledger tested the scenario on a private network fork and reported no real-user losses.<\/p>\n