Thread: How thousands of Slope wallets were hacked and how other wallets can avoid this 👇 
1/ First, the following theories are considered very unlikely and entirely rejected:
- issues in Solana core
- issues in SPL token
- crypto issues (e.g. weak RNGs)
- widespread user devices compromise
- supply chain (compromised libraries)
- issues in Solana core
- issues in SPL token
- crypto issues (e.g. weak RNGs)
- widespread user devices compromise
- supply chain (compromised libraries)
2/ In the war room, we first hypothesized that wallets may be leaking mnemonics or private keys to Sentry.
After further investigation with the community, this is what we found:
After further investigation with the community, this is what we found:
3/ First, let's talk about Sentry.
Sentry is an event logging platform used for reporting errors in apps.
If a certain event occurs in the app, a request containing the details & environment is logged to the company's Sentry.
Many companies use Sentry on websites & mobile.
Sentry is an event logging platform used for reporting errors in apps.
If a certain event occurs in the app, a request containing the details & environment is logged to the company's Sentry.
Many companies use Sentry on websites & mobile.
4/ The Slope Wallet for iOS and Android uses Sentry for event logging.
Any interaction in the app would trigger an event log.
Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Thus, mnemonics were leaked to Sentry
s/o to @sniko_ for this screenshot:
Any interaction in the app would trigger an event log.
Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Thus, mnemonics were leaked to Sentry
s/o to @sniko_ for this screenshot:
5/ However, Slope has been using Sentry for only 1 week now.
**Hypothetically**, an attacker *with access to Sentry* could go through event logs and steal the thousands of mnemonics leaked in the past week
Then drain thousands of wallets.
**Hypothetically**, an attacker *with access to Sentry* could go through event logs and steal the thousands of mnemonics leaked in the past week
Then drain thousands of wallets.
6/ Wallets using Sentry or other analytics platforms need to be aware of what information is being logged.
With Sentry, it's possible to scrub data you don't want to be logged. This can be done with server-side scrubbing or in the Sentry SDK.
With Sentry, it's possible to scrub data you don't want to be logged. This can be done with server-side scrubbing or in the Sentry SDK.
7/ Furthermore, if sensitive data has been logged, remove it from Sentry.
Removing events is not enough, you must also remove the Sentry tags.
This can be done in "Project Settings > Tags" to remove any related data for a given tag.
Removing events is not enough, you must also remove the Sentry tags.
This can be done in "Project Settings > Tags" to remove any related data for a given tag.
8/ We highly recommend reading through Sentry's documentation:
• docs.sentry.io/platforms/java…
• docs.sentry.io/product/data-m…
• docs.sentry.io/platforms/java…
• docs.sentry.io/product/data-m…
9/ If you have used Slope, you should generate a new wallet and migrate your assets there.
The private keys previously used in Slope should be considered compromised.
The private keys previously used in Slope should be considered compromised.
10/ The investigation into this incident is still ongoing.
We have been working with other security researchers & firms to identify the root cause and will continue to work closely with them to release more details. Please follow @Zellic_io for more updates.
We have been working with other security researchers & firms to identify the root cause and will continue to work closely with them to release more details. Please follow @Zellic_io for more updates.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
