BitFinding

@BitFinding

Building the future of transaction signing and the last line of defense in blockchain.

England, United Kingdom

bitfinding.com

Replies Reposts Media

BitFinding
@BitFinding
Sep 7
1/2 ⚠️ One action displayed. 257 authorized ⚠️ Our full write up is live: Signature overflow attacks on Ledger. A Clear Signing bug broke a critical security property: What you see is what you sign. 🔎 Technical details + PoC:
Signature overflow attacks on Ledger
From bitfinding.com
1
BitFinding
@BitFinding
Aug 28
1/2 We helped Ledger identify and fix a High-severity Clear Signing vulnerability. Ethereum app 1.19.0–1.22.2 is affected. Update to 1.22.3+. Our advisory: bitfinding.github.io/publications/L…
4
BitFinding
@BitFinding
Aug 26
If you use Ledger for Ethereum, please update the Ethereum-app to v1.22.3. This is a new release. Go update your Ledger. Again.
BitFinding
@BitFinding
Aug 23
This exploit is similar to our not-WYSIWYS attack reported in March. We followed responsible disclosure and are waiting for the fix to be widely adopted before dropping the POC
TestMachine
@testmachine_ai
Aug 22
🚨Every Ledger running the Ethereum app is vulnerable to signature substitution A malicious dApp with WebHID access could race an APDU during your transaction review and swap the tx being signed while the device still shows the original Here's what you need to know:
00:00
1
BitFinding
@BitFinding
Aug 19
Research update: we’ve been heads down on several projects we’ll be sharing soon. One is our investigation into reorgs, orphans, and cross-chain execution triggered before confirmation. Several bridges are in scope, and we’re sharing findings with their teams privately.
1