Ledger's CTO calls for standardized vulnerability disclosure in crypto, supported by Trezor, to enhance security and user protection.
Ledger's Chief Technology Officer, Charles Guillemet, has called for coordinated vulnerability disclosure to become a standard practice in the cryptocurrency industry. His open letter, published on September 7, has received backing from Trezor and other organizations.
"AI has made vulnerability discovery cheap, but it hasn’t made responsible disclosure optional," Guillemet stated.
Guillemet proposed a systematic four-step process for handling vulnerabilities: confidential reporting, verification of the issue, agreement on a fix timeline, and eventual public disclosure. He suggested a typical timeframe of 90 days for this process, though it may vary with the severity of the issue.
He highlighted the challenges posed by AI, which has lowered the barrier for vulnerability discovery, allowing inexperienced individuals to exploit flaws and share their findings prematurely on social media.
"Security remains a cat-and-mouse game, but with many more cats, and the user suffers," he noted.
Guillemet pointed out three problematic scenarios that can arise: misrepresenting fixed bugs as current threats, disclosing vulnerabilities before patches are available, and sensationalizing findings for attention. He warned that these practices are particularly harmful in the cryptocurrency sector, where mistakes can lead to irreversible losses.
Three Appeals to Users and Researchers
Guillemet urged users to promptly install updates, as the rapid evolution of exploit tools heightens risks. He also appealed to new researchers to report verified findings through official channels and to provide specific details when disclosing issues publicly.
"This is not bureaucracy. This is the difference between enhancing ecosystem security and creating a threat to users for a few likes," he emphasized.
Lastly, he called on companies and security professionals to endorse coordinated disclosure publicly and to reward researchers who follow these guidelines.
Trezor's Response
In response, Trezor’s Head of Security, Jan Komarek, emphasized that the discovery of vulnerabilities does not equate to a security failure. He highlighted the cyclical nature of security, where issues are found and fixed continuously.
"The secondary damage often turns out to be more severe than the harm caused by the bug itself," Komarek remarked.
He supported the 90-day timeline for disclosures and noted that if a company fails to address an issue within this timeframe, the researcher should be able to publish details.
The discussion also referenced a recent incident involving the Bitcoin sidechain Liquid Network, which saw approximately 4,000 BTC, valued at around $320 million, withdrawn by unknown parties. Komarek criticized the lack of responsible disclosure surrounding this event, pointing out that it violated established principles.
The Dispute Over Error Disclosure
Earlier in August, a vulnerability in Ledger's Ethereum application was publicly disclosed by TestMachine, which led to further discussions about disclosure practices. Guillemet responded by stating that Ledger had already resolved the issue before the public announcement.
Overall, the push for standardized vulnerability disclosure aims to enhance security within the cryptocurrency sector, protecting users from undue risks while fostering a more collaborative environment among researchers and companies.
