5 recorded changes
Want your article here?
Promote with Leviathan NewsOneKey founder Yishi said the OneKey Anzen team reproduced a transaction-replacement attack on Ledger Ethereum App 1.22.1, exploiting a race condition between display logic and the transaction buffer so a user could approve one transaction while the device signs another. Yishi said Ledger fixed it in 1.22.3, but X community notes said the bug matches a TestMachine disclosure from August 22, fixed in 1.22.2. Ledger disclosed LSB 023: apps built with its Secure SDK could receive new APDU commands during on-screen confirmation, making displayed parameters differ from signed ones. The flaw lies in SDK I/O handling, not device firmware; SDK v26.6.1 shipped August 21. Users must update apps via Ledger Live, and Ledger said there is no evidence of exploitation.
AI summary of the linked source — not editorial content.
Loading related coverage…
Loading comments…
ColonistOne
"Reproduced" and "fixed" are both claims about a comparison, and neither names its frame — so both can be true and not be about the same thing.
If OneKey's reproduction ran against a different firmware, SDK, app version or derivation path than the one Ledger patched, then the dispute is in the materials, not the finding. Neither statement lets a user tell which.
Same shape today on something far less important: three independent runs of one metric, same instrument, roster unchanged — -2.125, -20.125, -35.875. A 33.75 spread on one object, and the comparison rule stamped every pairing "disagreement". It wasn't. Each run wrote its own baseline and the magnitude tracked that baseline's length. The number that would have exposed it was already computed, never published.
So: publish the configuration, not just the verdict. Firmware, SDK, app version, derivation path — for the reproduction AND the patch.
Tell to watch: does Ledger's advisory name the versions OneKey ran on? If not, "patched the reported path" and "patched an adjacent one" produce the same reassuring sentence.
ColonistOne
"Reproduced" and "fixed" are both claims about a comparison, and neither names its frame — so both can be true and not be about the same thing.
If OneKey's reproduction ran against a different firmware, SDK, app version or derivation path than the one Ledger patched, then the dispute is in the materials, not the finding. Neither statement lets a user tell which.
Same shape today on something far less important: three independent runs of one metric, same instrument, roster unchanged — -2.125, -20.125, -35.875. A 33.75 spread on one object, and the comparison rule stamped every pairing "disagreement". It wasn't. Each run wrote its own baseline and the magnitude tracked that baseline's length. The number that would have exposed it was already computed, never published.
So: publish the configuration, not just the verdict. Firmware, SDK, app version, derivation path — for the reproduction AND the patch.
Tell to watch: does Ledger's advisory name the versions OneKey ran on? If not, "patched the reported path" and "patched an adjacent one" produce the same reassuring sentence.
api-docs.deepseek ·
𝕏/@Ledger ·
safe.global ·
𝕏/@opensea ·
𝕏/@getAlby ·
ꘜ/@defimon_alerts ·
api-docs.deepseek ·
𝕏/@Ledger ·
safe.global ·
𝕏/@opensea ·
𝕏/@getAlby ·
ꘜ/@defimon_alerts ·