fix: ledger fall back to blind signing when clear-sign fails#522
Merged
dawnseeker8 merged 7 commits intomainfrom May 6, 2026
Merged
fix: ledger fall back to blind signing when clear-sign fails#522dawnseeker8 merged 7 commits intomainfrom
dawnseeker8 merged 7 commits intomainfrom
Conversation
Mirror metamask-extension PR #41948: try clearSignTransaction first, then signTransaction(..., null) when resolution fails. Re-throw user rejection (0x6985) without fallback. Add @ledgerhq/hw-transport as a runtime dependency.
dawnseeker8
changed the title
Contributor
Author
|
@metamaskbot publish-preview |
|
Preview builds have been published. See these instructions (from the Expand for full list of packages and versions. |
montelaidev
previously approved these changes
Apr 30, 2026
Contributor
montelaidev
left a comment
montelaidev
left a comment
There was a problem hiding this comment.
Looks good, didn't test because the logs is the same as the one on extension
… signing fallback and bump @metamask/keyring-sdk version to 2.1.1.
The Check Changelog CI parses the Unreleased section and requires the entry to link to the actual PR number. Replace the `#TODO` placeholder with the real PR link so the check passes. Co-authored-by: Cursor <cursoragent@cursor.com>
montelaidev
previously approved these changes
May 6, 2026
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 37fa711. Configure here.
…h-ledger-bridge - Added `@ledgerhq/hw-transport` dependency to `package.json`. - Modified import statement in `ledger-mobile-bridge.ts` to use type-only import for `Transport` from `@ledgerhq/hw-transport`.
montelaidev
approved these changes
May 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mirror metamask-extension PR #41948: try clearSignTransaction first, then signTransaction(..., null) when resolution fails. Re-throw user rejection (0x6985) without fallback. Add @ledgerhq/hw-transport as a runtime dependency.
Note
Medium Risk
Changes Ledger mobile transaction-signing flow to fall back to blind signing on
clearSignTransactionerrors, which can affect how transactions are presented and approved on-device. Guarding against explicit user rejection (APDU0x6985) reduces risk but this still touches critical signing behavior.Overview
Improves Ledger mobile transaction signing by attempting
clearSignTransactionfirst and falling back to blind signing (signTransaction(hdPath, tx, null)) when clear-sign resolution fails, while re-throwing explicit on-device user rejections (TransportStatusErrorstatus0x6985) to avoid re-prompting.Moves
@ledgerhq/hw-transportto a runtime dependency, adds warning logging on fallback, and extends tests to cover both the fallback path and the user-rejection no-fallback path.Reviewed by Cursor Bugbot for commit b71f9a7. Bugbot is set up for automated code reviews on this repo. Configure here.