Last month, Solana blockchain faced yet another attack<\/a> in a series of recent attacks targeting blockchains. Blockchains are the ultimate record of crypto assets and recording transactions from one wallet to another on the ledger guarantees that money gets transferred and the operation virtually remains anonymous.<\/p>\n This is an absolute gem for criminals because 1) few financial and security regulations exist in this modern decentralized finance (DeFi) world as of now and;\u00a0 <\/span>2) anonymity on the blockchain guarantees a very difficult investigation trajectory and almost no way to pinpoint where the money actually went.\u00a0<\/span><\/p>\n Imagine hundreds of D.B Coopers<\/span><\/a> jumping from hundreds of airplanes every day with bags full of cash \ud83d\ude00<\/p>\n<\/blockquote>\n The top vectors of blockchain attacks are smart contract vulnerabilities, protocol and design flaws, crypto-related bugs, rug-pull scams, etc. Out of these, wallet compromises and key leaks together accounted for 14% of total attacks last year!<\/span><\/a><\/p>\n On August 3, around USD $6 million worth of SOL, BTC, ETH, USDT and other currencies on Solana as well as Ethereum blockchains were siphoned off from thousands of individual wallets and transferred to hackers\u2019 wallets and that eventually were sent to various money laundering wallets.<\/p>\n SlowMist was the first to report<\/span><\/a> this attack and begin investigations. While a thorough investigation <\/span><\/a>is still in progress, some undeniable facts have emerged on how the attack occurred. The key to the attack as well as the discovery of the attack is the Slope wallet app that boasts itself as \u201cRobinhood of DeFi.\u201d<\/p>\n Like thousands of other apps, Slope used a log monitoring tool called Sentry to track various events in the app. This is common practice and not considered harmful in itself. However, note that technically anything that the app produces while interacting with a human can be tracked and sent to a corresponding log tracking server.<\/p>\n In this instance, the Slope wallet from v2.2.0+ was quietly collecting sensitive data such as mnemonics and private keys from the app and sending it to their own hosted Sentry server. While Sentry specifically recommends<\/span><\/a> users to scrub sensitive data, it is objectively difficult to implement each and every piece of advice.<\/p>\n Moreover, different apps will have different definitions and requirements of what data is considered sensitive. It is impossible to really create a generic guideline on what to log and what not to log. However, in this instance, logging mnemonics are absolutely a sure-shot way to provide a stepping stone for an attacker to mount attacks on wallets.<\/p>\n A mnemonic is usually a collection of 12 words that a user can choose when they create a new crypto wallet. In the case a user is unable to use the password, they can use the mnemonic to recover the wallet. It provides a more user-friendly recovery system in the absence of a centralized password store and recovery system. This is so crucial that some people use metal seed plates<\/a> to store their mnemonics.<\/em><\/p>\n While SlowMist investigation is still not complete, there is no doubt that the decision to log mnemonics was a dangerous one. The analysis suggests that approximately 31% of known compromised victim wallets were the same ones that were found in the Sentry logs. Therefore, the mnemonic leak could merely be a correlation or could actually be the root cause. We won\u2019t be surprised either way. This is how someone who is able to access the hosted sentry server could have accessed it:\u00a0<\/span><\/p>\n But, we know developers and we empathize with them. This is not their fault \u2014 this era\u2019s coding paradigm is complex. Modern software is built upon layers and layers of libraries and other code. Logging has gone from printing something pretty on a local console in a basement machine to monitoring billions of actions in millions of devices and machines running globally. Fine-grained data is collected on all user actions and about their details \u2014 sometimes as damning as critical wallet details. The data has now exited the confines of the app. And it is not coming back.\u00a0<\/span><\/p>\n No amount of operational safety and privacy policies can alone help fix this. The nature of modern software prevents detailed manual scrutiny of such leaks. What we need are tools that help give us visibility into what is happening to the data across large codebases so that privacy\/security engineers or a developer themselves can identify specific points of possible leaks before they can happen. This approach of shifting left has been used in security before \u2014 it is now time to implement it for data and privacy.\u00a0<\/span><\/p>\n While we can\u2019t really get the source of the Slope app, we can surely try to recreate the scenario with a sample app. Let\u2019s take this simple BitcoinWallet<\/span><\/a> app that I have modified and add some Sentry logging to an imaginary endpoint:\u00a0<\/span><\/p>\n\n
The Hack<\/h2>\n
The Steep \u2018Slope\u2019 of Trust\u00a0<\/span><\/h2>\n
What Is a Mnemonic?<\/strong><\/em><\/h3>\n
![\"\"](\"https:\/\/cdn.thenewstack.io\/media\/2022\/09\/263bb74b-wallet-leak-mnemonic.png\")
<\/p>\nHow to Fix This?<\/h2>\n
Hunting for a Mnemonic Leak Using Privado Open Source<\/b><\/h2>\n