Ledger fixed a vulnerability affecting certain clear signing flows in its Ethereum application before another security company disclosed the issue publicly, Chief Technology Officer Charles Guillemet said on Aug. 23, pushing back against claims that the flaw remained unresolved.
What the Vulnerability Involved
Clear signing is designed to show transaction details in a readable format on a Ledger device before the user approves them, allowing users to check amounts, addresses, and smart contract actions instead of authorizing an unreadable transaction hash. Security company TestMachine said a malicious application could allegedly send a competing command while a user was still reviewing the original transaction on their Ledger screen.
The reported issue involved Application Protocol Data Unit communication between the connected application and Ledger's Ethereum app. TestMachine claimed this could let an attacker replace an expected transaction with another action before the user completed approval. One possible result involved replacing a limited transaction with a broader token approval.
Ledger's Response
Guillemet said Ledger Donjon, the company's internal security research team, discovered the bug using an AI-powered vulnerability research system. Ledger deployed the fix approximately two weeks before his statement, according to his post. Users with current Ledger firmware and applications are protected.
He disputed how TestMachine presented the disclosure, saying the company contacted Ledger's bounty program after the fix had already shipped. He described claims that the problem remained active as manufacturing fear for attention. No independently verified reports of funds stolen through this specific vulnerability had emerged by Aug. 24.
Which Devices Were Affected
TestMachine said its Azimuth system found the issue during an autonomous scan and validated it on a Ledger Flex. The company said shared code made other models potentially relevant, including Nano X, Nano S Plus, Stax, and Apex devices. However, a complete public proof of concept demonstrating fund theft across every named device was not available at publication time.
Ledger's public Ethereum application repository shows several security-related changes during August, including fixes involving signing states, application context handling, and message finalization. The available records do not clearly identify which change corresponds to the disclosed clear signing issue.
What Users Should Do
Ledger users should update the Ledger Wallet software, device firmware, and installed Ethereum application. Updating only the desktop or mobile interface may not replace an outdated application running on the hardware device. Users should also verify transaction details directly on the secure device screen and avoid blind signing, which remains risky because the device cannot present every smart contract action in a readable format.
