Is Ledger Open Source?

The Ledger ecosystem goes way beyond hardware, aiming to give users the knowledge and power to look after their own assets. Offering world-class security is at the core of Ledger’s ethos—not just for its hardware, but for its software too. A team of world class experts and engineers, along with the white hat hackers in the Ledger Donjon, work together to make sure your crypto stays safe from both physical and digital threats when transacting within the ecosystem. Due to this team and Ledger’s world class security model, Ledger devices have never been hacked. 

Alongside this focus on security, Ledger also has a few other core tenets, namely; a commitment to its community and dedication to self-custody. In short, it aims to be as transparent and trustless as possible. To work towards these values, Ledger is committed to open sourcing as much of its code as possible. 

That said, Ledger is uncompromising on security–which can cause some tension with open sourcing. To explain, revealing all of the code to anything may also reveal a vulnerability. 

And code powers not just your device’s operations but also its firmware updates and accompanying software. In short, there’s a lot of code in the Ledger ecosystem, and some might not be as safe to share as others.

 As a result, some of Ledger’s ecosystem is open source, but other parts are not. It’s all about keeping your crypto as secure as possible.

Let’s explore the ecosystem:

Is Ledger Fully Open Source?

Most Ledger products are already open source. For example, Ledger Live is fully open source meaning many developers contribute to its apps and devices. Plus there are also over 150 open-source apps within the Ledger ecosystem. 

There are still some parts of the Ledger ecosystem that are not fully open source. However, Ledger is committed to open sourcing as much of its tech as possible, including portions of the operating system. So Let’s look at each part of the ecosystem:

Is Ledger Live Open Source?

Yes, Ledger Live code is completely open source under an MIT license, meaning you are free to copy or fork it at will. That means anyone can become a developer of an app on Ledger Live. Some developers may decide to create a solo integration where there is no interaction with Ledger, no code review or Ledger-led support for your community. This is completely fine, but the rarer of the two options.

The other option is to have your blockchain or app supported fully in Ledger Live. This involves various Ledger teams, including product, and support, which will help you release an app that pleases everyone.

That said, no matter which method you choose, Ledger Live code is completely open-source, so the choice is really yours.

Is Ledger Firmware Open Source?

For now, Ledger firmware is partly open source. Firmware primarily refers to the embedded software and operating system of Ledger devices. So far, the cryptographic library, which is part of Ledger OS, is already completely open source. Plus Ledger Recover will also follow suit, allowing everyone to audit cryptographic protocols and even build their own fragments backup provider.

In addition, the Ledger SDK is also fully open source, meaning that anyone can build applications for a Ledger device. Beyond that, 50+ applications in its ecosystem are already open source, with more to follow.

There will be more open sourcing plans to come for the operating system but these may take some time. That’s because lots of elements of Ledger’s operating system, BOLOS, can not be revealed.

To explain, BOLOS operates on the Secure Element chip, a specialized tamper-proof chip often used in passports and bank cards. This level of security is only achievable using this chip, however, the terms of using it prohibit Ledger from revealing the operating system’s full workings . That means any code released must be refactored to abstract the chip-specific characteristics.

So, while Ledger’s Operating System and firmware are not fully open-source, there are lots of elements within them that are. Plus, there’s a lot more planned in the months and years to come. Open sourcing has always been a key consideration with Ledger, and the open source roadmap is testament to that fact. 

What is the Ledger Open Source Roadmap?

Ledger’s open source roadmap consists of four phases; each with an important part to play. And believe it or not, two out of these four phases are already complete. For the full details–and to see what’s coming next—check out the Ledger Open Source roadmap. 

Is My Crypto Safe on a Ledger?

Yes—your crypto is safe within the Ledger ecosystem: Ledger devices have never been hacked. This is due to a combination of security measures:

Firstly, Ledger devices sign transactions offline and operate separately to your internet connected device. This keeps your crypto safe from two key threats; malware and spyware. To clarify, if you have malware or spyware on your internet connected device, your Ledger device (and its screen) will be unaffected. You can always trust the details of a transaction on your Trusted display. 

Next, your device is also protected from physical hacks, so even if your device falls into the wrong hands, they can’t access your accounts.  Ledger devices use the Secure Element, a specialized chip often used in passports and bank cards. Although not all of the operating system, BOLOS, is open source, parts of it are. Plus more elements will become open source in the future. The chip itself is tamper-proof; resistant to countless physical attacks. Plus the devices and their firmware are thoroughly tested by white-hat hackers in the Donjon. This means to gain physical access to your wallet, someone must know the PINcode, so of course your PINcode must remain a secret. 

To follow, Ledger Live provides a secure gateway to access web3 apps and services. It’s also fully open-source, allowing you to verify each app’s code. Plus, all Ledger Live apps benefit from a clear signing plugin that allows you to read every transaction in human readable form. This lets you explore web3 apps without worrying about malicious smart contracts.

Ledger Can’t Protect You From Yourself

However, transactions from apps outside the ecosystem may not be so easy to understand. Unfortunately, the Ledger ecosystem can not protect you from mistakes. Thus, it’s imperative to be vigilant of malicious smart contracts which prompt you to sign away your assets when using a Ledger device in conjunction with a third party wallet.

In the same vein, you should make sure never to reveal your secret recovery phrase or private keys. While Ledger devices can protect your private keys from online threats, they cannot prevent you from revealing your private keys or secret recovery phrase by storing it in the cloud or in an unsafe environment. Make sure to keep your secret recovery phrase in a safe and secret location so that the only person with access to your account is you. 

 With self-custody comes responsibility, so ultimately the final gatekeeper is you.