CertiK: Discovered a critical vulnerability in Solana Phone that allows user assets to be stolen within tens of seconds

Recently, CertiK discovered a critical bootloader vulnerability in Solana Phone. CertiK testing experts successfully jailbroken the phone in just one minute and looted all the assets in it in just a few steps. The vulnerability stems from an insecure "bootloader unlock" feature. In addition to stealing user assets, it also exposes all personal data stored on the device. More than 2,100 devices have been put at serious risk since early April. Given the complexity of the vulnerability and the need for physical access, CertiK has informed Solana of the vulnerability and publicly released this vulnerability alert to protect Web3 users and prompt them to take effective measures to protect their assets. CertiK released a video on November 15 analyzing the details of the vulnerability. They emphasized that the vulnerability is not limited to Solana Phone and recommended that relevant projects and developers take immediate action to strengthen bootloader protection.