ChainSecurity disclosed a historical ECDSA vulnerability in the Vultisig wallet that allowed an attacker with one compromised device to recover the full private key. The flaw exploited repeated malicious signing messages and error responses to reveal bits of an internal protocol seed, bypassing the security guarantees of multi-party computation.
Vultisig released iOS version 1.45.71 on August 21 and Android version 1.0.118 on August 25 to address the issue. These updates stop automatic retries after detecting malicious participant errors and display specific warnings to users, ensuring the application enforces the library’s stop condition rather than treating the failure as a generic error.
Key facts
- ChainSecurity identified a flaw where continued signing attempts after an error could leak key material.
- The vulnerability required one already-compromised signer and many malicious signing messages to exploit.
- iOS v1.45.71 was released on August 21 to implement the fix for Apple devices.
- Android v1.0.118 was released on August 25 to implement the fix for Android devices.
- The updates map malicious-party error codes to device identifiers and bypass automatic retries.
- ChainSecurity stated it had not reviewed the fixes or audited other parts of the protocol at the time of disclosure.
Why it matters
The disclosed flaw demonstrates that rejecting a transaction alone does not preserve the separation between signers if the application continues the exchange after a critical protocol failure. By failing to enforce the library’s stop condition, the previous implementation allowed failed signing attempts to reveal secret information even when no usable transaction signature was produced.