Can you please do a patch for ledger for the 0.x version of wagmi?

[fionnachan]

We aren't on v1 yet but would really love to get a patch
context: https://x.com/bantg/status/1735279127752540465?s=20

[fionnachan]

@tmm and @jxom

[tmm]

If you don't use the LedgerConnector, then there should be no issue. The Ledger team has fixed the issue upstream as well.

[bamnenim-kryptonium]

https://github.com/wevm/wagmi/releases/tag/wagmi%401.4.12

The team hot-fixed this issue here

[hkrawczyk]

@bamnenim-kryptonium what I'm saying is that after 4 days it is still disabled...
so the hot-fix is breaking the long-term functionality of the product.

[tmm]

You are welcome to fork the LedgerConnector into your codebase. We likely won't add it back to Wagmi until we are satisfied with security practices from the Ledger team. In the meantime, you can still connect to Ledger through the WallectConnectConnector.

[Wozacosta]

@tmm Hey!

We likely won't add it back to Wagmi until we are satisfied with security practices from the Ledger team

Do you expect more than what was is listed in the "Remedial actions" part of the December's exploit postmortem (link here)? I understand internal audits are hard to track externally and the only real measure will be the time without an exploit, but some concrete measures have already been implemented:

The ledger connect-kit repo now monitors if the published version is different from the github repo one. Here's the github action.

Would you be open to a PR introducing the LedgerConnector (updated for the v2) that loads the @ledgerhq/connect-kit package (pinning its version in a package.json dependencies).

[ComradeAERGO]

We likely won't add it back to Wagmi until we are satisfied with security practices from the Ledger team

Hi there @tmm, I work at Ledger with @Wozacosta and we're currently working on a PR to bring the connector back to wagmi v2.

Can you please detail the "security practices" you require to make our PR acceptable for you?

[tmm]

You tell us! Feel free to detail it in your PR and we can go from there. Want to see if our thinking aligns before sharing.