ZenGo Rapidly Patches Wallet Security Issue After In-Depth Evaluation
From CertiK
New York, NY, April
11 (GLOBE NEWSWIRE) -- CertiK, the leading blockchain security
solutions provider, announces a successful collaboration with the ZenGo Wallet, the
popular self-custodial MPC wallet provider, to fortify the security of its
wallet application against privileged user attacks. The joint effort
demonstrates CertiK's commitment to conducting proactive in-house research and
collaborating with external parties to raise the standard of security and
transparency across the Web3 world.
CertiK's SkyFall team conducted a comprehensive
evaluation of ZenGo's security design and implementation, focusing on the
wallet's ability to protect against advanced threats, such as advanced malware
and rooted devices. Despite ZenGo's robust security features, including its
two-party signature scheme, TEE-based device protection, and biometric-enforced
user sign-up and recovery, CertiK identified an inappropriate protected
cryptographic management API issue that could be exploited in certain
scenarios.
ZenGo responded quickly to CertiK's findings,
deploying a patch to fix the identified issue. CertiK's thorough review of the
patch confirmed its effectiveness, significantly bolstering the wallet's
security against privileged user attacks and rendering it more secure than
traditional wallets which are still vulnerable to this type of attack. This
collaboration demonstrates the importance of proactive security evaluations and
the value of working with experienced security firms like CertiK to identify
and address potential vulnerabilities.
“I’m proud of the work our engineers did to
identify and address this security issue in one of the most secure mobile
wallets,” said Kang Li, CertiK’s Chief Security Officer. “Even the MPC
technology provides a strong defense, the specific implementation details can
expose security risks if not designed well. This collaboration with ZenGo
highlights the need for comprehensive security evaluations and reinforces
CertiK’s commitment to raising the industry standard of security and
transparency.”
“It was a pleasure to work closely with the CertiK
team in a clear, professional, and proactive manner to quickly fix this issue
and jointly publish a report to increase community awareness. CertiK's
discovery and ZenGo's fix helped ensure that ZenGo is hardened against
privileged attacks that traditional wallets cannot protect against,” said Tal
Be'ery, ZenGo's CTO and co-founder.
This partnership between CertiK and ZenGo showcases
the shared commitment of both companies to create a more secure and transparent
ecosystem for the rapidly expanding Web3 world. Builders, founders, and users
can take confidence in the knowledge that CertiK's comprehensive security suite
and proactive research are raising the bar for security standards across the
entire industry.
To learn more about CertiK’s suite of security
solutions for Web3, visit certik.com and
follow along on Twitter at @CertiK and @CertiKCommunity. To learn more about
the ZenGo wallet, follow @ZenGo on Twitter
and visit ZenGo.com.
About CertiK
CertiK is a pioneer in blockchain security,
leveraging best-in-class AI technology and expert manual review to protect and
monitor blockchain protocols and smart contracts. Founded in 2018 by professors
from Yale University and Columbia University, CertiK secures the Web3 world, by
applying cutting-edge innovations from academia to enterprise, enabling
mission-critical applications to scale with safety and correctness. CertiK has
audited more than 3,900 Web3 projects and secured hundreds of billions of
dollars of market capitalization.
Alnura Belyalova
Director of PR, Luna
PR
alnura@lunapr.io
SOURCE : Luna PR