Ledger Live showed cancelled RBF Bitcoin payments as received (BigSpender)

On 2 July 2020 the wallet company ZenGo published research it called BigSpender on how some Bitcoin wallets handle Replace-By-Fee (RBF) transactions. According to SiliconANGLE and Decrypt, Ledger Live, Edge and Breadwallet were affected. Ledger’s bulletin LSB-012 states that Ledger Live increased the user’s balance as soon as an unconfirmed incoming transaction was received and did not decrease it when that transaction was cancelled.

According to Ledger, an attacker could send a high-value transaction with minimal fees and then cancel it, so that the victim believed the payment had arrived; the bulletin adds that Send Max could be blocked when the displayed balance exceeded the real one. SiliconANGLE describes three forms: a basic double spend, an amplification variant in which repeated cancelled payments inflate the balance, and a denial-of-service variant. Ledger’s hardware wallets were not affected; Ledger CTO Charles Guillemet told Decrypt the hardware was unaffected by this user-interface flaw and called it trickery rather than a vulnerability.

LSB-012 credits Tal Be’ery and Oded Leiba of ZenGo, who reported through Ledger’s bug bounty programme, and states the issue is fixed from Ledger Live 2.7.0. Decrypt reported on the day of disclosure that Ledger had fixed only the amplified variant in version 2.6 and that other variants were not yet fixed; Guillemet said an update would add a banner whenever an incoming transaction was unconfirmed. ZenGo notified the vendors about 90 days before publication.

What Ledger advises:

• Update to Ledger Live 2.7.0 or later.
• Check suspicious incoming transactions on a block explorer, which marks unconfirmed transactions.