Fix: Ledger Blind Signing Auto-Reset & EIP-712 Nested Multicall Revert (0x6985 / 0x6a80)

Following a Ledger firmware upgrade (Ledger OS 2.4+ on Nano X/S Plus, or OS 1.4+ on Stax and Flex) or an update to the on-device Ethereum (ETH) Application (v1.12.0+), thousands of crypto users and Web3 developers discover that their previously functioning decentralized application interactions fail without warning.

When attempting to execute a trade on Uniswap, interact with Aave, sign an off-chain order on CowSwap, or approve an ERC-4337 smart account transaction, the browser extension (MetaMask, Rabby, Rainbow) or dApp UI freezes and surfaces one of two hex errors:

EthAppCommandError: Ledger device: Condition of use not satisfied (denied by the user?)
Status code: 0x6985

or:

EthAppCommandError: Ledger device: Incorrect data received
Status code: 0x6a80

If your Ledger is also failing on complex calldata or heavy multisig transactions, review our analysis on Fixing Ledger Nano Out of Memory on Complex EVM Calldata Payloads.

Technical Cause 1: Security Policy Firmware Resets

By design, Ledger’s secure operating system (BOLOS) enforces a strict security policy: any modification to the binary firmware image or an application update invalidates and wipes local application configuration state stored in non-volatile flash (NVRAM).

This design prevents malicious updates from inheriting compromised permissions. However, it means that whenever you perform an update via Ledger Live:

1. Blind Signing is automatically toggled from Enabled $\to$ Disabled.
2. Debug Data is toggled from Enabled $\to$ Disabled.
3. Nonce Display is toggled back to standard view.

When your wallet sends an APDU command containing arbitrary contract calldata (such as a router swap or Permit2 authorization), the Ledger hardware evaluates:

$$\text{if } (\text{payload.isContractCall} \land \neg\text{Settings.BlindSigningEnabled}) \implies \mathbf{return} \ \texttt{0x6985}$$

Because the setting is disabled, the secure element never presents the transaction details to the user’s screen; it aborts immediately.

Technical Cause 2: Clear Signing Parser Buffer Overflow (0x6a80)

With recent updates, Ledger rolled out Clear Signing for popular protocols. Instead of raw bytecode, the screen displays readable method calls.

However, modern protocols frequently nest complex dynamic arrays inside EIP-712 typed data:

• Uniswap v4 Hooks: Structs containing nested arrays of fee tiers, tick bounds, and hook data.
• Permit2 Batch: Multiple token approvals grouped into an array of arbitrary length.
• Gnosis Safe Multicalls: Arrays of encoded sub-calls.

The Secure Element microcontroller (STMicroelectronics ST31 / ST33) has limited static RAM (typically 16 KB to 32 KB). When an incoming EIP-712 payload has more than 3 levels of recursive nesting or exceeds 4,096 bytes of schema metadata, the hardware parser fails mid-deserialization and throws:

$$\texttt{APDU Status Word: 0x6a80 (INCORRECT_DATA)}$$

Step-by-Step Restoration Protocol

Follow these exact device instructions to re-enable blind signing across different Ledger models:

1. Ledger Nano S Plus & Ledger Nano X

1. Connect your Ledger to your computer and enter your PIN.
2. Navigate to and open the Ethereum (ETH) app on your device screen.
3. Press the right button to navigate to Settings and press both buttons to enter.
4. The first option displayed will be Blind signing. It will state: Disabled.
5. Press both buttons to change it to Enabled.
6. Press the right button to navigate to Back and press both buttons to exit settings.
7. Keep the Ethereum app open while retrying the transaction.

2. Ledger Stax & Ledger Flex (Touchscreen Interface)

1. Unlock your device with your PIN and open the Ethereum app.
2. Tap the Settings icon (gear icon) in the top-right corner.
3. Locate the Blind Signing toggle.
4. Tap the switch until it indicates Active / Enabled.
5. Tap the back arrow to return to the ready screen.

Developer Defense: Catching 0x6985 in Frontend dApps

When a user’s Ledger has blind signing disabled, native Web3 providers throw generic user rejected exceptions, causing users to believe your dApp is broken.

Implement client-side error interception using Viem to display a tailored instructional toast:

// ledger-error-interceptor.ts
import { BaseError } from 'viem';

export function parseLedgerError(error: unknown): {
  isLedgerBlindSignError: boolean;
  userMessage: string;
} {
  if (error instanceof BaseError) {
    const errorString = error.walk()?.message || error.message;

    // Check for 0x6985 status code or condition not satisfied
    if (
      errorString.includes('0x6985') ||
      errorString.includes('CONDITIONS_OF_USE_NOT_SATISFIED') ||
      errorString.includes('Condition of use not satisfied')
    ) {
      return {
        isLedgerBlindSignError: true,
        userMessage:
          'Transaction rejected by hardware. Your Ledger Blind Signing was likely disabled after a recent update. Please open the Ethereum App on your Ledger, go to Settings -> Blind Signing, set to Enabled, and retry.',
      };
    }

    // Check for 0x6a80 buffer overflow
    if (errorString.includes('0x6a80') || errorString.includes('INCORRECT_DATA')) {
      return {
        isLedgerBlindSignError: false,
        userMessage:
          'Payload too large for Ledger memory (0x6a80). Please split your transaction batch or disable debug data on your device.',
      };
    }
  }

  return {
    isLedgerBlindSignError: false,
    userMessage: 'Transaction failed. Please check your wallet connection.',
  };
}

Troubleshooting WebHID & Connection Timeouts

If your device continues to reject connections after enabling blind signing, check for browser-level USB contention:

1. Close Ledger Live: Ledger Live claims exclusive HID interface locks. If Ledger Live is running in the background, browser requests will hang indefinitely.
2. Clear Chrome HID Permissions: In Google Chrome, navigate to chrome://settings/content/usbDevices and revoke stale device handles.
3. Switch from WebHID to WebUSB: If using MetaMask, go to Settings > Advanced > Preferred Ledger Connection Type and toggle between WebHID and Ledger Live Bridge depending on OS compatibility.

By verifying on-device Blind Signing settings following any firmware or app update and properly handling APDU status words 0x6985 and 0x6a80, hardware wallet users and dApp developers can restore uninterrupted, secure transaction signing.