Community Trust ScoreVerified
ChainSecurity disclosed on Oct. 21 a historical flaw in the ECDSA signing implementation of the Vultisig crypto wallet that allowed the recovery of a full private key under specific attack conditions. The vulnerability required one compromised signer and the transmission of numerous malicious signing messages to extract bits of an internal protocol seed. Vultisig merged code changes on Android and iOS on Aug. 21 to address the issue, two months before the public disclosure.
Flaw mechanics and seed exposure
The disclosure details how the Vultisig application mishandled a critical stop signal from the underlying signing library. In a multi-party computation (MPC) wallet, signing authority is distributed among key shares. The library assumes that after a critical error, further signing attempts must stop until the internal protocol seed is rotated. This seed is a setup secret; responses to malicious messages revealed bits of this seed, which eventually enabled the recovery of the other share and the full private key.
According to ChainSecurity, the application previously displayed a generic error message and did not enforce the library’s stop response. This allowed the attacker to continue the exchange, observing whether the other signer returned an error. The security consequence is that a failed signing attempt can reveal secret information even when it does not produce a usable transaction signature. Rejecting the transaction alone did not preserve the separation between signers because the application continued to interact with the malicious participant.
August code changes and release notes
Android change #5658 and iOS change #5235 were both merged on Aug. 21. The descriptions for these changes indicate that the previous code compared signing failures with the library’s success result without separately handling malicious-party ban errors. The old signing routines could retry up to three times while the user received a generic failure message.
The new code recognizes DKLS signing library malicious-party error codes 100–109 during session setup, message processing, and signature completion. Both the Android and iOS changes map the flagged participant to a device identifier and carry a dedicated error past automatic retries. They also display a localized warning against using the flagged device again. On Android, the exception also bypasses relay recovery.
The GitHub notes for iOS v1.45.71, dated Aug. 21, list PR #5235. The Android v1.0.118 release, dated Aug. 25, lists PR #5658. These changes demonstrate that the applications now distinguish a cryptographic verdict about a participant from an ordinary signing failure, preventing retry behavior that could be dangerous when the library identifies a malicious signer.
Audit scope and remaining verification
Vultisig’s security documentation states that Trail of Bits audited the Silence Laboratories DKLS23 library in 2024. It notes that mobile and desktop application audit reports will be linked when published. At the time of disclosure, ChainSecurity stated it had not reviewed Vultisig’s fixes or audited other parts of the protocol. The published changes leave protection across restarted sessions unverified, as the reviewed materials do not provide a full affected-version and vault-configuration matrix or explain enforcement after user-initiated restarts.
Frequently Asked Questions
What specific error codes did the Vultisig update address?
The Android and iOS updates recognize DKLS signing library malicious-party error codes 100–109 during session setup, message processing, and signature completion.
When were the code changes merged relative to the disclosure?
The Android and iOS code changes were merged on Aug. 21, two months before the public disclosure by ChainSecurity on Oct. 21.
