The vulnerability analysis of Qubic Wallet exposed a security issue that is easy to overlook: private keys don’t have to be stolen directly. If the random numbers used to generate them can be predicted, an attacker may be able to gain control of an account.
SlowMist found that Qubic Wallet uses Math.random(), which is not suitable for generating account seeds that require cryptographic security. Some outputs from the same random-number sequence are also written to the dejaVu field in network packets. According to its local PoC, under certain conditions, obtaining six related values in a row may be enough to recover the random number generator’s internal state and, in turn, reconstruct the account seed and private key.
What makes this type of vulnerability dangerous is that a wallet may appear to work normally, while users have little way of knowing whether their accounts are at risk. The security issue lies in the underlying implementation, and users cannot be expected to avoid it through their everyday actions.
However, the report describes a potential attack path; it does not establish that the previously reported theft of QU was carried out this way. Qubic previously disclosed that 1,404 wallets had been compromised, with losses of approximately 2.94 trillion QU. Affected users should refer to the security announcements and response plans published by the project team.
SlowMist found that Qubic Wallet uses Math.random(), which is not suitable for generating account seeds that require cryptographic security. Some outputs from the same random-number sequence are also written to the dejaVu field in network packets. According to its local PoC, under certain conditions, obtaining six related values in a row may be enough to recover the random number generator’s internal state and, in turn, reconstruct the account seed and private key.
What makes this type of vulnerability dangerous is that a wallet may appear to work normally, while users have little way of knowing whether their accounts are at risk. The security issue lies in the underlying implementation, and users cannot be expected to avoid it through their everyday actions.
However, the report describes a potential attack path; it does not establish that the previously reported theft of QU was carried out this way. Qubic previously disclosed that 1,404 wallets had been compromised, with losses of approximately 2.94 trillion QU. Affected users should refer to the security announcements and response plans published by the project team.