Solflare Crypto Wallet Vulnerability - "xpass exploit"

[blandy]

Yes, I remember their system seeming being owned, although they denied this. Too many high value wallets were compromised, likely by themselves I'd suspect. Users need to remember that they are putting a lot of trust into the owners of these software wallets.

[cyclone]

@blandy Thanks! Hopefully Solflare users will transfer their crypto to a secure wallet before a threat actor exploits this in the wild.
@oe3p32wedw That is correct. The encryption function Solflare used is similar to Phantom, which is secretbox with pbkdf2-sha256 KDF. To clarify, the encryption function is secure, but the vulnerability is what Solflare did after the encryption function.

[tychotithonus]

Wow, amazing work!
Suggestion: add a timeline to your GitHub info page, to document your interaction with the org.

[rickyc2024]

Cyclone, this very much annoys me. How could you do this? I found this vulnerability and I had ALREADY reported it.

[rickyc2024]

This post is deleted!

[cyclone]

I independently found the vulnerability while reverse engineering the encryption function, wrote the solflare_pwn toolkit, and reported the vulnerability on Feb 12 to Solflare with a followup email on Feb 15. All of this with timestamps is disclosed on my post above.

This is the 2nd time rickyc2024 has publicly taken credit for my solflare_pwn toolkit and my work on this project. To once again clarify, he has nothing to do with solflare_pwn or me discovering the vulnerability.

@rickyc2024 has been banned.

# EDIT 2025/02/21
I've also banned his dup accounts below since running multiple accounts on the forum is not allowed. General Forum Rules: https://forum.hashpwn.net/post/11
@rickyc2024 banned
@rickyig2025 banned
@donotban banned
@youremail banned
@jdjwjdiw banned

[blandy]

I can confirm I've worked with @cyclone and also have a working C# copy of the decrypter and also the vulnerability.

Nice work @cyclone

[cyclone]

@blandy Thanks, great job porting this over to C#!

[cyclone]

New GitHub Release:
https://forum.hashpwn.net/post/434

[dawp9duhn9gom]

@cyclone will you create versions of these for firefox aswell?

[cyclone]

@dawp9duhn9gom
I can port the toolkit to Firefox if there is enough interest. However, I generally do not write tooling for Firefox due to the very low global usage only being approx 2%, while Chrome based browsers dominate the global usage at over 70%.