BitFinding @BitFinding

Building the future of transaction signing and the last line of defense in blockchain. bitfinding.com England, United Kingdom Joined January 2018

Tweets

74
Followers

615
Following

4
Likes

141

BitFinding @BitFinding

2 weeks ago

2/2 Ledger addressed the issue in Ethereum app v1.22.3+. Users should update before relying on Clear Signing for affected flows. 🧪 Reproducing the PoC? Use a separate test device with a fresh, disposable seed and no funds.

0 0 5 121 0

View Details

BitFinding @BitFinding

2 weeks ago

1/2 ⚠️ One action displayed. 257 authorized ⚠️ Our full write up is live: Signature overflow attacks on Ledger. A Clear Signing bug broke a critical security property: What you see is what you sign. 🔎 Technical details + PoC: bitfinding.com/blog/signature…

1 7 19 2K 4

View Details

BitFinding @BitFinding

3 weeks ago

@testmachine_ai Our issue was reported in March. donjon.ledger.com/lsb/024/

0 0 0 119 1

View Details

BitFinding @BitFinding

3 weeks ago

1/2 We helped Ledger identify and fix a High-severity Clear Signing vulnerability. Ethereum app 1.19.0–1.22.2 is affected. Update to 1.22.3+. Our advisory: bitfinding.github.io/publications/L…

4 9 30 8K 3

View Details

BitFinding @BitFinding

3 weeks ago

2/2 A compromised frontend could make the trusted screen omit actions still covered by the signature. We demonstrated the Safe attack end to end and confirmed the same display/signature divergence in Aave and Morpho multicall flows. PoC coming soon. In the meantime, update.

0 0 2 380 0

View Details

BitFinding @BitFinding

3 weeks ago

A compromised frontend could make the trusted screen omit actions that remained covered by the device signature. We demonstrated the Safe attack end to end and confirmed the same display/signature divergence in Aave and Morpho Clear Signing flows. Stay safe - update

0 0 0 20 0

View Details

BitFinding @BitFinding

4 weeks ago

If you use Ledger for Ethereum, please update the Ethereum-app to v1.22.3. This is a new release. Go update your Ledger. Again.

0 6 9 769 0

View Details

BitFinding @BitFinding

4 weeks ago

However, in a world where everyone gets access to the latest models at the same time and agents are watching everyone and everything, unreleased fixes or vulns can’t sit in the open until Patch Tuesday.

0 0 3 34 0

View Details

BitFinding @BitFinding

4 weeks ago

We acknowledged and applaud that @Ledger is upping their offensive security with the latest LLMs to find these vulnerabilities before the bad guys do

1 0 3 60 0

View Details

BitFinding @BitFinding

4 weeks ago

This exploit is similar to our not-WYSIWYS attack reported in March. We followed responsible disclosure and are waiting for the fix to be widely adopted before dropping the POC

TestMachine @testmachine_ai

4 weeks ago

🚨Every Ledger running the Ethereum app is vulnerable to signature substitution A malicious dApp with WebHID access could race an APDU during your transaction review and swap the tx being signed while the device still shows the original Here's what you need to know:

38 85 343 323K 354

1 5 11 848 0

View Details

BitFinding @BitFinding

a month ago

Any funds recovered during our reorg experiments have already been returned to their owners. More research and technical write-ups are coming. Big thanks to @thedaofund, @Quantstamp, @wintermute_t, and @Giveth for supporting our work.

0 0 4 63 0

View Details

BitFinding @BitFinding

a month ago

We also reported security issues affecting a widely used hardware wallet. We’re coordinating with the relevant team and will publish the technical details when it’s appropriate to disclose them responsibly.

1 1 3 127 0

View Details

BitFinding @BitFinding

a month ago

Research update: we’ve been heads down on several projects we’ll be sharing soon. One is our investigation into reorgs, orphans, and cross-chain execution triggered before confirmation. Several bridges are in scope, and we’re sharing findings with their teams privately.

1 5 15 595 0

View Details

BitFinding @BitFinding

3 months ago

Huge thanks to @Giveth and everyone involved to make this happen. Thanks to this initiative we can spend more time in public good projects that benefit the whole ecosystem.

Giveth @Giveth

3 months ago

TheDAO's Ethereum Security QF Round matching funds have officially been distributed 🛡️ What started as a 500 ETH matching pool from @thedaofund ultimately grew to 638 ETH+ thanks to support from across the ecosystem. 134 projects have now received funding to continue their work

9 14 62 7K 1

0 3 10 493 0

View Details

Giveth @Giveth

3 months ago

The latest Giveth newsletter is out 💜 Inside: 🛡️ @thedaofund Ethereum Security QF Round results and 638 ETH+ distributed 📊 A new dashboard to explore the round data 🤝 GIVfriend of the month: @wintermute_t 🙌 Featured project: @BitFinding 🏆 Newly verified projects: @walnut_dev, @dedaub and much more

3 8 38 11K 0

View Details

BitFinding @BitFinding

4 months ago

@Cotabe_M @thedaofund @Giveth @ECHInstitute @FunctorNetwork @zachxbt @RollAMate @l2beat @DeFiHackLabs @blockscout @AragonProject @blockful_io @eth_limo 🫡

0 0 1 33 0

View Details

BitFinding @BitFinding

4 months ago

It's great having @DecurityHQ securing the blockchain at the milliseconds game. Competition in this space is what will make the last line of defense stronger!

Decurity @DecurityHQ

4 months ago

4/ Balancer V2 reached 54% of funds-at-risk in minute one, 93% by minute five. Even at that speed, @BitFinding's whitehat bot intercepted the attacker in the very next block - 12 seconds after the first malicious tx. ~$1M returned to Balancer DAO.

2 0 2 1K 0

0 3 6 533 0

View Details

thedao.fund @thedaofund

4 months ago

An AI agent that monitors every block, hunting smart contract hacks would be great right? Well @BitFinding is building it, and it has rescued $1.3M and counting. Learn more: youtube.com/watch?v=WUWT9W… Support: qf.giveth.io/project/bitfin…