Insufficient field size check in Protobuf

[tsusanka]

Impact: Theft of Funds
Scalability: Remote (Interaction)
Severity: Critical
Fixed in: Firmware 1.10.3
Reported by: Stellar Development Foundation
Date reported: 2021-07-12

Details

Without this check, an attacker could trick the user into signing a Stellar transaction moving their assets while thinking they are signing a ManageData transaction.

Fix

trezor/trezor-firmware@dd65780

Read more

• Official blogpost