Malicious change in mixed transactions

[tsusanka]

Impact: Theft of Funds
Scalability: Remote (Interaction)
Severity: Critical
Fixed in: Firmware 2.1.8
Reported by: Marko Bencun
Date reported: 2019-10-01

Details

A specially crafted multisig transaction could leverage a ToCToU bug to include a change output of an attacker, which wasn't confirmed by the user.

Fix

trezor/trezor-firmware@8eb6ce0

Read more

Official blogpost