Ledger Bitcoin app SegWit fee overpayment vulnerability

Ledger’s security bulletin LSB-010 describes a flaw in the Bitcoin app’s implementation of BIP-143, the SegWit signing scheme, that let an attacker increase a transaction’s fee without the change being confirmed on the device. Bitcoin Optech describes the underlying fee overpayment attack as affecting stateless hardware wallets that sign SegWit inputs, and Decrypt reports it was disclosed to several hardware wallet makers, including Ledger and Trezor.

According to Ledger, the attacker must first compromise the user’s client software and then get the user to sign a transaction at least twice, which Ledger considers realistic because the first attempt can be aborted with a fake error. Successful exploitation makes the user lose funds as fees, and the attacker can collude with a miner to collect them. Ledger lists the affected apps as Bitcoin and the forks with SegWit support that use it as a library, including Bitcoin Cash, Bitcoin Gold, Digibyte, Komodo, Litecoin, Qtum, Vertcoin, Zcash and others.

Ledger states the issue is fixed in version 1.4.0 of the Bitcoin app. Bitcoin Optech reports that, unlike Trezor, which began requiring full previous transactions for SegWit inputs, Ledger displays a warning when SegWit inputs are spent without full copies of their previous transactions.

Saleem Rashid reported the flaw through Ledger’s bug bounty programme. Decrypt reports that he disclosed it to hardware wallet makers about three months before the coordinated publication on 3 June 2020.