The light is still not clear on the Solana hack which is now a week old. For its part, Phantom claims to have no security flaws to deplore, and Slope, for its part, reveals that it found a vulnerability in its services, but expresses doubts as to its connection with the hack as a whole.
Phantom says it found no security holes in its system
A week after the $4 million-plus hack on the Solana (SOL) blockchain that reportedly affected as many as 9,000 different wallets and whose cause is still unknown, Phantom, one of the affected wallets, says it has no vulnerabilities to report.
“After nearly a week of investigation, our team has found no evidence that Phantom’s systems were compromised in the August 2 security incident.”
According to the statement, Phantom has undergone several audits by OtterSec and Halborn Security, 2 independent companies specializing in blockchain auditing, which have had no flaws to report to date.
A statement that makes sense, corroborating the claims of Solana’s technical teams that the affected addresses have at one time or another interacted with Slope’s wallet mobile app.
Slope in a more complicated situation
In a statement issued on August 11, Slope acknowledges finding a vulnerability in one of its services over the period of July 28 to August 3. Specifically, the flaw in question would have allowed “inadvertent recording” of sensitive data in the event that the applications generated an error message.
However, according to Slope, although the dates coincide, this flaw is not responsible for the hack we have seen. Thus, we can read in the release:
“As confirmed in previous Ottersec interim reports, the investigative team cross-checked all hacked addresses (9,232 addresses in total) against all addresses exposed to the Sentry database vulnerability: The number of hacked addresses is larger than the total number of addresses exposed by the Sentry server. A fraction (1,444 addresses) of the total Sentry server exposure was confirmed dumped.”
In other words, the number of wallets impacted by the flaw in question at Slope is less than the total number of wallets hacked.
It should be noted that the Sentry Service mentioned by Slope refers to the file on which the seed phrases of the various wallets were located. An OtterSec report dated August 4 indicated that the mnemonic phrases in the folder were not encrypted and were written in readable text.
To that, Slope responded that it’s unlikely the hacker had access to the keys in question, as the file was secured with 3-factor authentication and HTTPS encryption.
On August 5, Slope had also issued a statement promising a 10% reward to the hacker if he decided to return the funds within 2 days.
