Solflare Crypto Wallet Vulnerability - "xpass exploit"

[cyclone]

During a recent audit of the Solflare Crypto Wallet v1.74.2 browser extension, I came across a major vulnerability that allows the encrypted seed phrase and private keys to be recovered -- without requiring the wallet password to decrypt them. This "xpass exploit" seems to only affect newer Solflare wallets, with version 1.74.2 February 7, 2025 being the latest at the time of this writing.

This means a Solflare wallet and all of its crypto can be instantly compromised if an attacker gains access to the user's PC -- whether physical, or via malicious software.

If you use Solflare, I would highly recommend you immediately transfer all your crypto to a trusted wallet since your crypto is not safe in Solflare.

I have contacted Solflare via chat (Feb 12, 2025) and email (Feb 15, 2025) to make them aware of this vulnerability and will give them time to release a patch before I publicly release a full writeup.

Timeline of reporting:
2025-02-12 @15:36 (CST)
Chat transcript snippet with Solflare Tech Support:
(transcript is in Solflare's time zone of CET)

2025-02-15 @17:29:50 (CST)
Email sent to Solflare (vulnerability info redacted):

Stay tuned. The writeup will be posted on my GitHub:
https://github.com/cyclone-github/solflare_pwn

Solflare Chrome Browser Extension:
https://chromewebstore.google.com/detail/solflare-wallet/bhhhlbepdkbapadjdnnojkbgioiodbic

Solflare Website:
https://solflare.com

This post is solely meant to inform the crypto community of the vulnerability in this crypto wallet. Hopefully, Solflare will promptly patch this vulnerability.

[secretscribe1]

Will you post the code how to do this?

[oe3p32wedw]

This vulnerability, as I understand, is directly related to the wallet files, and not to the algorithm?

[blandy]

Nice work cyclone incredible and hugely worrying that a crypto wallet provider can be so incompetent. Bad enough Atomic Wallet was using a fast hashing algo (MD5) for the IV and Key values for the AES encryption, but this is a complete failure.

[oe3p32wedw]

@blandy The developers of the atomic wallet are scammers themselves. There have been waves of funds disappearing from users more than once. I also have a friend who kept funds here, he kept the seed phrase only on paper and he had a generated password. The funds disappeared at the same time, as with many AW users. I heard that all this was allegedly done by Lazarus, but during the community research it turned out that this is not the first case in the history of the wallet, which the developers kept silent about.

[blandy]

Yes, I remember their system seeming being owned, although they denied this. Too many high value wallets were compromised, likely by themselves I'd suspect. Users need to remember that they are putting a lot of trust into the owners of these software wallets.

[cyclone]

@blandy Thanks! Hopefully Solflare users will transfer their crypto to a secure wallet before a threat actor exploits this in the wild.
@oe3p32wedw That is correct. The encryption function Solflare used is similar to Phantom, which is secretbox with pbkdf2-sha256 KDF. To clarify, the encryption function is secure, but the vulnerability is what Solflare did after the encryption function.

[tychotithonus]

Wow, amazing work!
Suggestion: add a timeline to your GitHub info page, to document your interaction with the org.

[rickyc2024]

Cyclone, this very much annoys me. How could you do this? I found this vulnerability and I had ALREADY reported it.

[rickyc2024]

This post is deleted!

[cyclone]

I independently found the vulnerability while reverse engineering the encryption function, wrote the solflare_pwn toolkit, and reported the vulnerability on Feb 12 to Solflare with a followup email on Feb 15. All of this with timestamps is disclosed on my post above.

This is the 2nd time rickyc2024 has publicly taken credit for my solflare_pwn toolkit and my work on this project. To once again clarify, he has nothing to do with solflare_pwn or me discovering the vulnerability.

@rickyc2024 has been banned.

# EDIT 2025/02/21
I've also banned his dup accounts below since running multiple accounts on the forum is not allowed. General Forum Rules: https://forum.hashpwn.net/post/11
@rickyc2024 banned
@rickyig2025 banned
@donotban banned
@youremail banned
@jdjwjdiw banned

[blandy]

I can confirm I've worked with @cyclone and also have a working C# copy of the decrypter and also the vulnerability.

Nice work @cyclone

[cyclone]

@blandy Thanks, great job porting this over to C#!

[cyclone]

New GitHub Release:
https://forum.hashpwn.net/post/434