Zilliqa discloses vulnerability in signer app

• Zilliqa disclosed a vulnerability affecting its app for Ledger signers that could expose private keys.
• The issue is limited to Zilliqa's application and does not affect Ledger hardware or Ledger-developed software.
• Zilliqa said it is developing a remedy and advised affected users to follow its guidance.

Zilliqa disclosed a vulnerability in its app for Ledger signers that could allow attackers to recover users' private keys, with the issue affecting Zilliqa's application rather than Ledger's hardware wallet or software.

The disclosure clarifies that the vulnerability originates from Zilliqa's implementation, meaning Ledger devices and Ledger-developed applications are not affected by the flaw.

Zilliqa disclosed the vulnerability and confirmed it is working on a remedy for users of the affected application.

According to Zilliqa, the issue is confined to its app build for Ledger signers, with no vulnerability identified in Ledger firmware, Ledger Live or any Ledger-developed application.

Zilliqa advised affected users to follow its security guidance while the company develops a fix, while Ledger has not announced any hardware or software changes because the vulnerability is outside its products.

Ledger hardware wallets support third-party applications developed by blockchain projects, with each project responsible for maintaining and securing its own application code.

The disclosure highlights the distinction between vulnerabilities in third-party wallet applications and the underlying Ledger hardware platform, with Zilliqa responsible for both the disclosure and remediation of this issue.