---

Learn More

CertiK, a blockchain security research outfit, has identified and publicized a significant security flaw within the Solana Saga smartphone. The smartphone boasts an integrated hardware wallet, intending to provide a fortified environment for Web3 functionalities.

CertiK published a video on Twitter that illustrates the exploit in action. The attack is a "bootloader unlock” attack which would supposedly allow a malicious actor to install a hidden backdoor in the phone and obtain unauthorized root access to the device. This is a concern given the phone's emphasis on crypto-asset management and secure transactions.

This potential breach is particularly alarming for a device like the Solana Saga, which debuted in April of the current year with built-in features tailored for decentralized apps (dApps) and cryptocurrency operations.

Despite the critical nature of CertiK's findings and the implications for users' private data, including the security of crypto wallet details and private keys, Solana has rejected the finding of a security issue secific to their device.

A spokesperson from Solana Labs has contested the assertions made by CertiK regarding the Saga phone's security, stating that the video shared by CertiK does not demonstrate any real or known risk to the device. According to Solana Labs, unlocking the bootloader—a process shown in Android's Open Source Project documentation as possible on many Android phones—requires several steps, including user authentication via passcode or fingerprint.

They emphasize that bootloader unlocking necessitates active user engagement and awareness, as it erases the device's data, with multiple warnings issued to the user during the process.