Ledger Security Bulletin 025

Evidence record

Read the original source ↗

Claim-level citations (4)

• supportsLedger fixed Ethereum signing-flow flaws found during internal automated/AI-assisted review: Ledger LSB-025 documents a separate swap-flow issue in which a token approval could be accepted in place of the intended payment.

  SRC-LEDGER-LSB025

• supportsLedger fixed Ethereum signing-flow flaws found during internal automated/AI-assisted review: For the swap flaw, exploitation required control of the transaction submitted during a swap; the beneficiary and quantity remained constrained to the already accepted swap parameters, and a separate later transaction was required to move funds.

  SRC-LEDGER-LSB025

• supportsLedger fixed Ethereum signing-flow flaws found during internal automated/AI-assisted review: The swap-path approval/payment confusion was fixed in Ethereum app 1.22.3, published August 25, after internal automated review identified the missing operation-type check on April 28.

  SRC-LEDGER-LSB025

• supportsLedger fixed Ethereum signing-flow flaws found during internal automated/AI-assisted review: Ledger states it has no evidence that the disclosed Ethereum signing issues were exploited against users.

  SRC-LEDGER-LSB025