Vultisig patches ECDSA flaw enabling private key recovery

ChainSecurity disclosed on October 21 a historical flaw in the ECDSA signing implementation of the Vultisig crypto wallet that allowed the recovery of a full private key. The vulnerability required one compromised signer and the transmission of multiple malicious signing messages to exploit a mishandled stop signal in the application’s code.

Malicious Signer Exploitation

Vultisig operates as a multi-party computation (MPC) wallet, distributing signing authority among key shares so that enough shares can cooperate to produce a standard blockchain signature without assembling the full private key during normal operation. In a two-device arrangement, compromising one participant should leave an attacker dependent on the other device’s approval. However, the disclosed flaw allowed an attacker who had already compromised one signer to send many malicious signing messages and observe whether the other signer returned an error.

According to ChainSecurity, those error responses revealed bits of a reusable internal protocol seed. This seed is an internal setup secret. The underlying library assumed that further signing would stop after a critical error until the seed was rotated. The Vultisig application, however, displayed a generic error message and did not enforce the library’s stop response. By continuing the exchange, the attacker could eventually recover the other share and the full private key. This meant that a failed signing attempt could compromise the wallet even if it produced no usable transaction signature, as rejecting the transaction alone did not preserve the separation between signers.

August Code Updates

Android and iOS maintainers merged code changes on August 21, two months before the public disclosure by ChainSecurity. The changes addressed the issue where the old code compared signing failures with the library’s success result without separately handling malicious-party ban errors. Previously, signing routines could retry up to three times while the user received only a generic failure message.

The new code recognizes the DKLS signing library’s malicious-party error codes, specifically codes 100 through 109, during session setup, message processing, and signature completion. Both the Android and iOS updates map the flagged participant to a device identifier and carry a dedicated error past automatic retries. The applications now display a localized warning against using the flagged device again. On Android, the exception also bypasses relay recovery. These changes allow the apps to distinguish a cryptographic verdict about a participant from an ordinary signing failure.

The iOS v1.45.71 release, dated August 21, lists change #5235. The Android v1.0.118 release, dated August 25, lists change #5658. Vultisig’s vault descriptions distinguish between Fast Vault, which uses one user device with VultiServer holding the second share, and Secure Vault, which uses two or more user-held devices without VultiServer. The reviewed disclosure and application materials do not provide a full matrix of affected versions and vault configurations.

Audit Scope and Verification

Vultisig’s security documentation states that Trail of Bits audited the Silence Laboratories DKLS23 library in 2024. The documentation notes that mobile and desktop application audit reports will be linked when published. At the time of disclosure, ChainSecurity stated it had not reviewed Vultisig’s fixes or audited other parts of the protocol. Consequently, the fixes remained outside the scope of ChainSecurity’s assessment. The published changes leave protection across restarted sessions unverified, as the enforcement of the library’s stop condition throughout signing, including after user-initiated restarts, has not been fully established.