Skip to content

Ledger / Public disclosure

Clear-signing array count truncation

Review could show fewer operations than the signed transaction contains.

Source date: 2026-08-27Reviewed: 11 October 2026

Affected scope

Ethereum app 1.19.0–1.22.2

What the attack requires

Malicious host; particular descriptors and contracts accepting oversized arrays.

Response & remediation

What changed

Ethereum app 1.22.3.

What this finding establishes

Demonstration used a private fork; not evidence of customer theft.