Impact: Theft of Funds
Scalability: Remote (Interaction)
Severity: Critical
Fixed in: Firmware 2.3.0
Reported by: Saleem Rashid
Date reported: 2020-03-02

Details

A specially crafted multisig transaction could leverage a ToCToU bug to include a change output of an attacker, which wasn't confirmed by the user.

Read more

Official blogpost