Solana Labs Counters Security Claims on Saga Phone by CertiK

Solana Labs, the creator of the Solana Saga smartphone, has refuted claims by CertiK, a blockchain security company, regarding a supposed security flaw in their device. CertiK had stated in a recent post that the Saga phone, which is designed to support cryptocurrency transactions, had a critical security issue that could lead to a backdoor access vulnerability.

On November 15, CertiK shared a video suggesting that the Saga phone was susceptible to a 'bootloader unlock' attack. This type of attack, according to CertiK, could allow an intruder with physical access to the device to secretly install a backdoor. This backdoor could potentially compromise sensitive data, including cryptocurrency private keys.

Understanding the Bootloader Unlock Issue

The bootloader is a crucial part of a phone's operating system that starts up the device. CertiK's report to Cointelegraph suggested that exploiting this bootloader could lead to significant security breaches. However, Solana Labs countered this claim, explaining to Cointelegraph that the process of unlocking a bootloader is standard across many Android devices and is not a unique vulnerability of the Saga phone.

A spokesperson from Solana Labs clarified that unlocking the bootloader requires several steps, including the user's passcode or fingerprint. This process, they emphasized, involves clear warnings to the user and results in the device being wiped clean, including the deletion of all private keys.

Price Drop and Market Response

The Saga phone, which debuted in April 2022 with an initial price tag of $1,099, features a Web3-native DApp store aimed at integrating cryptocurrency applications into mobile technology. Despite its innovative approach, the phone experienced a significant drop in sales, leading Solana Labs to reduce its price to $599 four months after its release.

Solana Labs has dismissed CertiK's claims of a critical security flaw in the Saga phone, explaining that the bootloader unlock process is a standard security feature in many Android devices and is not a unique threat to the Saga phone.