OneKey Reproduces Transaction Replacement Attack on Outdated Ledger App
Security researchers demonstrate how a race condition in an old Ledger Ethereum app version could allow malicious transaction signing.
The OneKey Anzen security team has successfully reproduced a transaction replacement attack targeting an outdated version of the Ledger Ethereum application. The lab-based exploit demonstrates a critical failure in the "what you see is what you sign" security model of hardware wallets.
According to reports from Cointelegraph and other security outlets, the attack specifically targets version 1.22.1 of the Ledger Ethereum app. The exploit leverages a race condition between the device's display logic and the transaction buffer. This flaw allows an attacker to replace a legitimate transaction with a malicious one after the user has viewed the details on the screen but before the device signs and broadcasts the data to the network.
The Mechanics of the Exploit
Hardware wallets are designed to act as the final line of defense, ensuring that private keys never leave the device and that users manually verify every transaction. In a standard workflow, the device displays the destination address and amount, and the user presses a physical button to authorize the transfer. However, the vulnerability found in version 1.22.1 breaks this chain of trust by decoupling the visual confirmation from the actual data being signed.
Why It Matters
This reproduction highlights a systemic risk in the hardware wallet ecosystem: the reliance on software updates for security. While the physical hardware of a Ledger device may remain secure, the blockchain-specific applications running on that hardware are subject to bugs and vulnerabilities. If a user fails to update their apps, they remain exposed to known exploits that can divert funds to an attacker's address, regardless of the device's physical integrity.
Current Status and Mitigation
Ledger has already addressed this specific vulnerability. The flaw was patched in version 1.22.2 of the Ethereum application. Security experts emphasize that this incident serves as a stark reminder for all cryptocurrency holders to maintain rigorous update schedules for both their device firmware and individual app versions to prevent the exploitation of legacy bugs.