Ledger (embedded apps and Ledger Wallet)

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Discretionary, no published ceiling; sized on data sensitivity, report completeness, ease of exploit and risk to Ledger's users, and paid in Bitcoin │ not published │ not published Submit a vulnerability CVE history 1 Last 12 months 22 Lifetime Parsing/validation 35 % Memory safety 25 % Auth bypass 25 % Info disclosure 10 % Latest advisories Loading the feed Overview Ledger is the largest hardware-wallet vendor by units shipped, with a device population in the several millions, and the open-source half of its stack is disproportionately important next to the closed half. app-bitcoin-new and app-ethereum implement the transaction parsing and clear-signing logic behind every Ledger user's confirmation screen, and they are also the model third-party chain teams copy when writing their own Ledger apps, which is why cosmos/ledger-cosmos turns up independently in Immunefi's Cosmos scope. ledger-live , the MIT monorepo behind Ledger Wallet, is in turn a widely forked reference for multi-chain account discovery and derivation. A parsing bug in an embedded app is a blind-signing bug: the device shows the user one transaction and signs another, which is the exact failure mode a hardware wallet exists to prevent. Ledger runs the bounty itself through Donjon and publishes an explicit in-scope list of fourteen embedded apps plus Ledger Wallet desktop and mobile, but it publishes no reward table at all: "The decision to grant a reward for the discovery of a valid security issue is at Ledger's sole discretion", so there is no ceiling to quote and we will not invent one. Payment is in Bitcoin. Agree an amount in writing before you rely on it. sorona.xyz adds 1.25× on top of whatever Ledger awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Ledger's own line covers three scopes: "Ledger Bug Bounty Program covers our hardware devices, Ledger Wallet applications, as well as our web services." The open-source half of that is the embedded coin apps and the ledger-live monorepo behind Ledger Wallet The enumerated embedded apps, all Apache-2.0 under github.com/LedgerHQ, in the versions distributed through Ledger Wallet: app-bitcoin, app-bitcoin-new, app-ethereum, app-solana, app-xrp, app-monero, app-cardano, app-stellar, app-sui, app-tron, app-exchange, app-openpgp, app-security-key and app-recovery-check, with app-hyperliquid listed as coming soon Each app's whole surface, which is APDU command handling, transaction parsing and the clear-signing display logic, the confirmation flow, and the key derivation and SDK use underneath all of it Device firmware and the devices themselves: software attacks on firmware and hardware attacks on the product are both named in the Devices scope The device impacts Ledger names: PIN bypass, arbitrary code execution on the secure element or MCU, privilege escalation out of an app, bypass of the user's transaction confirmation, and sensitive memory leaks Ledger Wallet desktop and mobile, where Ledger asks for anything leading to loss of user funds, compromise of sensitive data or bypass of security controls: unauthorised transaction crafting, signing bypass, USB or BLE channel compromise, remote code execution, update-mechanism supply-chain attacks, genuine-device-check bypass and dApp sandbox escape Private data leakage from Ledger Wallet, named specifically as accounts, balances and xpubs Ledger's web services, but for critical findings only Out of scope Display discrepancies in Ledger Wallet where the device screen is correct, since the device screen is the trust anchor and the desktop display is not Theoretical vulnerabilities with no working device-level proof of concept Attacks that require pre-existing local access, installed malware, or physical access to an already-unlocked machine or device Third-party dApp bugs that do not affect Ledger Wallet beyond the dApp's own scope Denial of service against Ledger Wallet with no security impact, and dependency staleness without a demonstrated exploit The usual web non-issues: SPF and DMARC records, missing CSRF tokens, clickjacking, missing headers, scanner output, weak TLS ciphers without a proof of concept, and absent rate limiting Anyone resident in, or submitting from, a country against which France has issued export sanctions, who is disqualified from the program whatever the finding Model-generated findings, which an explicit anti-AI clause bars under a permanent-ban provision Most-valued findings A transaction-parsing defect in an embedded coin app that makes the device display something other than what it signs. This is the blind-signing case, the highest-impact class the program buys, and parsing is 35% of the expected distribution; in app-bitcoin-new or app-ethereum it reaches every Ledger user at once Bypass of the user confirmation step, so a transaction is signed without the physical button press that is supposed to authorise it Memory corruption in an embedded app that escalates to code execution on the secure element or leaks sensitive memory, 25% of the distribution and where parsing bugs and memory-safety bugs meet in this stack PIN bypass or any path that extracts key or seed material from the device, the single outcome hardware wallets are sold to prevent In Ledger Wallet, unauthorised transaction crafting, a compromised update mechanism, or a genuine-device-check bypass. Each turns the software half of the product into a delivery path against the hardware half Sandbox escape from a dApp inside Ledger Wallet that reaches the host application or the device channel, as against a bug confined to the dApp itself Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The proof of concept has to work at APDU level, driven through Speculos and Ragger or against a real device: a theoretical write-up of an embedded-app defect is not a submission here Rewards are paid in Bitcoin only, and the amount is at Ledger's sole discretion with no published table to appeal to Being resident in, or submitting from, a country against which France has issued export sanctions disqualifies you from the program There is an explicit anti-AI clause carrying a permanent-ban provision, so do not file model-generated findings you have not reproduced and understood yourself The program is expressly terminable without notice, which is worth weighing before you invest a long research effort in it Give Ledger the chance to diagnose and fix before the details reach anyone else; the Security Team states it is usually in touch within 24 hours Disclosure Coordinated with Ledger's own security team through the Donjon submission form, with findings published afterwards as Donjon security bulletins and credited in a Hall of Fame. The terms require you to give Ledger the opportunity to diagnose and remedy the issue before details reach third parties or the public, so file with Ledger first and let sorona.xyz hold the finding until the bulletin is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability