Tangem SDK Android Offline Wallet Attestation Logic Flaw Vulnerability

A vulnerability exists in the Tangem SDK for Android, specifically in the offline wallet attestation process, prior to version 5.18.3. The issue arises because verification results are ignored during the initial scan of a card, potentially leading to incorrect attestation outcomes. Although this flaw may not have been exploitable in practice, it creates a lapse in the genuineness check process.

Impact

This vulnerability could result in improper wallet attestation, allowing cards to be incorrectly verified as genuine or vice versa, during the first scan.

Remediation

Users can update to Tangem SDK version 5.18.3 or later to address this vulnerability.