Ledger Ethereum app swap flow could sign a token approval in place of a payment

Ledger’s security bulletin LSB-025 describes a flaw in the Ethereum app’s handling of token payments signed for a swap reviewed in Ledger’s Exchange application. According to Ledger, the app checked the address and quantity of the payment but not the type of operation. Because a token approval uses the same address and quantity fields as a payment, an approval with the expected values passed the checks and was signed without being shown to the user.

Ledger states that exploitation requires control of the transaction submitted to the device during a swap, for example through a hostile or compromised swap provider or malware between the Exchange application and the device. The user would believe they were paying a fixed amount while the signed transaction granted a standing spending permission for that amount. Ledger lists the limits: the beneficiary must be the swap’s validated deposit address, the amount and asset must match what the user accepted, the permission moves no funds by itself and can be revoked, and the swap does not complete, which makes the anomaly noticeable. Outside the swap flow, approvals are displayed and confirmed normally, according to the bulletin.

Ledger lists Ethereum app 1.20.0 through 1.22.2 as affected and states that 1.22.3, published on 25 August 2026, verifies that the signed operation is a token payment and rejects extra appended data before comparing address and quantity.

Ledger’s automated review identified the missing check on 28 April 2026 and the correction was merged on 25 May, according to the bulletin; CryptoSlate and Coin360 note that the fix was absent from Ethereum app 1.22.2 released on 13 August. Ledger published the bulletin on 27 August 2026.

What Ledger advises:

• Install Ethereum app 1.22.3 or later and check the application version on the device; a firmware update alone does not replace the app.