Compromised Signer Could Extract Private Key Through Error Messages
ChainSecurity disclosed a historical ECDSA vulnerability in Vultisig, a multi-party computation wallet, on October 21, 2024. The flaw allowed one compromised signer to recover the full private key by sending many malicious signing messages and observing error responses that revealed bits of an internal protocol seed.
Vultisig distributes signing authority among key shares across devices. The vulnerability stemmed from how the wallet handled errors during ECDSA signing. The underlying Silence Laboratories DKLS23 library was designed to halt signing after a critical error until the seed was rotated, according to ChainSecurity’s analysis. However, Vultisig displayed a generic error message to users and did not enforce the library’s intended stop condition, allowing the application to continue processing.
The attack required an attacker to control one signer and send repeated malicious signing requests. Signing routines could retry up to three times, and the DKLS signing library recognized malicious-party error codes in the 100 to 109 range. By observing these error responses across multiple attempts, an attacker could extract bits of the seed and eventually reconstruct the full private key.
Vault Configuration and Attack Surface
Vultisig offers two configurations. Fast Vault uses one user device paired with VultiServer, a Vultisig component holding the second share. Secure Vault uses two or more user-held devices without VultiServer. ChainSecurity noted that “requiring several devices offers protection only if the software preserves that requirement when one participant starts misbehaving.” The disclosure did not specify which configurations faced the greatest risk or how many malicious messages an attacker would need to extract a key.
Fixes Released in August
Vultisig addressed the vulnerability through updates released in August 2024. An Android change (number 5658) and an iOS change (number 5235) were merged that month, with Android version 1.0.118 dated August 25. The fixes added handling to stop retries after critical errors and warn users of compromised devices. iOS version 1.45.71 incorporated the same protections.
Trail of Bits audited the Silence Laboratories DKLS23 library in 2024. ChainSecurity stated at disclosure that it had not reviewed Vultisig’s fixes or audited other parts of the protocol, leaving the completeness of remediation outside its assessment. The firm also noted that protection across restarted sessions remained unverified.
Remaining Unknowns
ChainSecurity’s disclosure did not provide a full matrix of affected versions and vault configurations, nor did it specify how many sessions an attacker would require to extract a key. The exact number of malicious signing messages needed to recover the private key was also not disclosed. Trail of Bits audit reports for Vultisig’s mobile and desktop applications were stated as forthcoming but not yet published at the time of ChainSecurity’s announcement.
