CertiK: Discovered a critical vulnerability in Solana Phone that allows user assets to be stolen within tens of seconds

CertiK has discovered a critical bootloader vulnerability in Solana Phone. CertiK's testing experts were able to jailbreak the phone in just one minute and "clean out" all of its assets with just a few steps.
The vulnerability stems from an insecure "bootloader unlock" feature. In addition to stealing user assets, it also exposes all personal data stored on the device. Over 2,100 devices have been at serious risk since early April. Given the complexity of the vulnerability and the need for physical access, CertiK has informed Solana of the vulnerability and publicly released this vulnerability warning to protect Web3 users and encourage them to take effective measures to protect their asset security.
CertiK released a video analyzing the details of the vulnerability on November 15. They emphasized that the vulnerability is not limited to Solana Phone and recommended that relevant projects and developers take immediate action to strengthen bootloader protection.