August updates block critical private key leak in crypto wallet Vultisig
Crypto wallet Vultisig addressed a critical vulnerability in its ECDSA signing implementation that could allow compromised signers to recover full private keys.
Vultisig, a crypto wallet utilizing shared signing technology, discovered a critical vulnerability in its ECDSA signing implementation. The flaw, identified by security researchers at ChainSecurity and disclosed on Oct. 21, involved mishandling of a critical stop signal that could allow one already-compromised signer to recover the full private key.
Multi-party computation (MPC) wallets like Vultisig distribute signing authority among key shares, requiring cooperation from enough shares to produce blockchain signatures without assembling the full private key during normal operation. In a two-device setup, compromising one device should theoretically leave the attacker dependent on the other device's approval.
Key vulnerability details
The disclosed flaw specifically affected ECDSA signing and required an initial compromise of one device. An attacker could then send numerous malicious signing messages and observe error responses from the other signer. These responses gradually revealed bits of a reusable internal protocol seed, eventually enabling recovery of the other share and the complete private key.
The internal seed is a setup secret that the library assumed would cause signing to stop after a critical error until the seed was rotated. However, the application only displayed a generic error without enforcing this stop condition, allowing continued communication that leaked more information.
August security updates
Vultisig addressed the vulnerability through updates released on Aug. 21 for Android (version #5658) and Aug. 25 for iOS (version #5235). The changes prevent automatic retries when the DKLS signing library identifies malicious participants, with error codes 100-109 now triggering specific handling.
The old code compared signing failures with the library's success result without separately handling malicious-party ban errors. The signing routines could retry up to three times, while the user received a generic failure message.
The updated applications now map flagged participants to device identifiers, carry dedicated errors past automatic retries, and display localized warnings against using compromised devices again. On Android, the exception also bypasses relay recovery mechanisms.
Wallet configurations and audit status
Vultisig offers different vault configurations: Fast Vault uses one user device with VultiServer holding the second share, while Secure Vault uses two or more user-held devices without VultiServer. The vulnerability's impact varied depending on these configurations, though the company did not provide a complete matrix of affected versions and setups.
Vultisig's security documentation notes that Trail of Bits audited the Silence Laboratories DKLS23 library in 2024. At disclosure, ChainSecurity clarified they had not reviewed Vultisig's fixes or audited other parts of the protocol, leaving those assessments outside their scope.
Related
