Clear Signing Explained: Three Hardware Wallet Bugs
What Is Clear Signing, and How Do Hardware Wallets Get It Wrong?
Clear signing means a hardware wallet shows readable transaction details on its own screen before you approve.
Three bugs disclosed in August 2026 showed the screen can still mislead: one let a compromised computer change details after display, one hid operations inside a batch, and one let an approval pass as a payment. All three now have fixes.
A hardware wallet is often pictured as a vault, yet clear signing is what makes it a witness, because the device tells you what you are about to approve. When that story is wrong, the vault still opens.
This explains the idea and the three bugs in plain English. For related security coverage, see the latest crypto news.
Clear Signing vs. Blind Signing: What's the Difference?
Blind signing means approving data the device cannot read, so the screen shows a hash or a line of hexadecimal. With clear signing, the device decodes the transaction and shows the recipient, asset, amount, and action.
An illustrative example: a swap prompt might read "Send 1,000 USDC, receive at least 0.42 WETH," instead of a long string of characters. The point of clear signing is that the computer or phone running the wallet may be compromised, while the device screen is meant to stay trustworthy.
How ERC-7730 Makes Transactions Readable
ERC-7730 is a standard JSON format that describes what a contract's function calls mean. The official ERC-7730 tutorial explains that each descriptor has three parts: a context that ties it to specific contract deployments, metadata that names the project, and display rules that map functions to readable labels.
The full ERC-7730 specification and the clear signing project site cover the details.
Descriptors sit in an open registry stewarded by the Ethereum Foundation. Auditors can attest to their accuracy, and each wallet decides which registry to trust. Inclusion does not mean a descriptor was audited.
If no descriptor exists for a contract, a wallet may fall back to blind signing. So clear signing is a system of decoding, display, and trust, not a single feature.
Why the Screen Can Still Fail
Clear signing only works when three things line up: the device decodes the data correctly, displays all of it, and signs exactly what it displayed.
The three bugs each broke a different step. Fixed releases now exist for all three, while wider standards adoption continues across wallets with no fixed dates.
No reported incident involved exposed private keys, and the maker says it found no evidence of exploitation. Even so, clear signing proved more fragile than most users assumed.
Bug One: Details Changed After You Looked
Tracked as LSB 023, this is the broadest of the three. The bulletin traces it to a shared software development kit, not a single app.
A computer could send a new command while an earlier one was still awaiting review, so signing parameters held in shared state could change after display but before signing.
Apps that did not validate their own state could show one set of parameters and sign another.
The flaw entered the kit in August 2025. The Ethereum app received app-level guards in version 1.22.2 in August 2026, the kit was corrected later that month, and apps were rebuilt.
Third-party developers were told to review their own handlers. A rival maker reproduced the issue against an older app version in a lab, according to published reporting. That was a laboratory reproduction, not a theft.
Bug Two: The Counter That Wrapped Around
Tracked as LSB 024, this flaw sat in how the Ethereum app handled batches of operations. The app read the count as a 16-bit number but stored the remaining count in an 8-bit field.
In the maker's proof of concept, a batch of 257 operations wrapped back to one, so the device displayed only the last operation while the signature covered the whole batch.
Exploiting it required a compromised computer and an unusually large attacker-controlled batch, and the proof of concept ran on a private network copy with no real funds.
The fix arrived in app version 1.22.3. Here, clear signing showed something true, but not everything.
Bug Three: A Payment That Was Really an Approval
Tracked as LSB 025, this flaw affected the swap payment path. The app checked the token, quantity, and destination but never verified that the requested action was a payment.
A malicious or compromised swap provider could substitute a token approval with matching details, and no extra prompt would warn the user.
The limits matter. Reports say it could not create an unlimited approval, switch tokens, or grant permission to an arbitrary address, and an approval alone does not move funds.
A later transaction would still be needed. The fix also shipped in 1.22.3. The official ERC-20 documentation explains how approvals work.
The Three Bugs Side by Side
Bug | What failed | Needed to exploit | Fixed in |
LSB-023 | Shared kit let details change after display. | Compromised computer | App 1.22.2, then kit fix |
LSB-024 | Only one of many operations shown | Compromised computer, huge batch | App 1.22.3 |
LSB-025 | Approval passed as a payment. | Malicious swap provider | App 1.22.3 |
Reports note that the fixes for the second and third bugs were merged months before release, and the bulletins do not explain the gap. The pattern is clear: clear signing breaks at the edges of what software checks.
How to Check and Revoke Token Approvals
An approval lets a contract spend a token on your behalf, often until you cancel it. Review old approvals now and then with the wallet's approval tool or an explorer's approval checker, and revoke any you do not recognize.
Revoking costs a small fee and stops future spending, but it does not undo a theft that already happened. The Ethereum security guide offers more safety basics.
What to Do Now
Update the Ethereum app itself, because a firmware update does not replace the app
Check the installed app version on the device, and aim for 1.22.3 or later
Read the action on the screen, not only the amount
Treat unexpected approval prompts as a reason to stop
Other wallet makers should also be checked, since clear signing logic differs between devices.
Security and Risk Considerations
Clear signing lowers risk but does not remove it
A compromised computer can still attack any weak link in decoding
Scammers exploit incident news with fake update links, and AI crypto scams show how convincing they can be
Consumer guidance on crypto scams lists common warning signs
No wallet makes clear signing foolproof.
Conclusion
Clear signing is a promise that what a wallet shows matches what it signs, and the August 2026 bulletins showed how that promise can quietly break.
One bug lived in a shared development kit, one came from a counter that wrapped around, and one let an approval pose as a payment.
No reported incident involved stolen keys, and the maker found no evidence of exploitation, yet each flaw shows that clear signing depends on decoding, complete display, and honest signing working together.
The practical lessons are simple. Update the app itself, confirm the version on the device, read the action and not only the amount, and review old token approvals from time to time.
Disclaimer: This article is for information only and is not financial, security, tax or legal advice. Cryptocurrency prices are volatile, security details change, and readers should verify all information with official sources and consult a qualified professional before moving funds.
