Vultisig, a cryptocurrency wallet using multi-party computation (MPC) for shared signing authority, patched a critical vulnerability in its ECDSA signing implementation following a security disclosure by ChainSecurity on October 21.
The flaw allowed an attacker with access to one compromised signer to potentially recover the full private key by sending multiple malicious signing messages. The vulnerability relied on observing error responses that revealed bits of an internal protocol seed, eventually enabling recovery of the second key share.
How the Vulnerability Worked
MPC wallets distribute signing authority among key shares, requiring multiple devices to cooperate and produce blockchain signatures without assembling the complete private key during normal operation. In a two-device setup, compromising one device should leave an attacker dependent on the second device's approval.
Vultisig's ECDSA implementation failed to properly handle a critical error signal when a malicious participant was detected. Instead of halting the signing process, the wallet's code would retry up to three times while displaying only a generic error message to the user. Each retry provided additional information that could be exploited to recover the private key.
The August Updates
Vultisig released fixes on August 21 for iOS (version 1.45.71, pull request #5235) and on August 25 for Android (version 1.0.118, pull request #5658). Both updates modified the applications to recognize and properly handle malicious-party error codes from the underlying DKLS signing library.
The changes introduced several protections:
- Recognition of specific error codes indicating a malicious participant during session setup, message processing, and signature completion
- Mapping of flagged participants to device identifiers
- Dedicated error handling that prevents automatic retries
- Localized warnings to users advising against using the compromised device again
Key Implications
The vulnerability demonstrates that failed signing attempts can leak sensitive information even when they produce no usable transaction signature. Security in multi-party computation depends on applications enforcing the library's stop conditions throughout the entire signing process, including after user-initiated restarts following a failure.
ChainSecurity noted that it had not reviewed Vultisig's fixes or audited other parts of the protocol at the time of disclosure. Vultisig's security documentation indicates that Trail of Bits audited the underlying DKLS23 library in 2024, with mobile and desktop application audit reports to be published separately.
