Malicious change in mixed transactions

Dilaporkan pada October 1, 2019

A specially crafted multisig transaction could leverage a ToCToU bug to include a change output of an attacker, which wasn't confirmed by the user.

Fixed in firmware 2.1.8.

Dilaporkan oleh Marko Bencun

Trezor Model T

Kerentanan yang teratasi

Dilaporkan komunitas. Diselidiki. Diselesaikan. Karena keamanan Anda tidak pernah opsional.