—score not recorded
Recovery and wallet import logging includes mnemonic words
Fixed in: v1.3.0+115 source tag; store rollout not independently verified
fixed publicly
details
- Finding IDs
- F-PROTON-WALLET-FLUTTER-001
- Status
- fixed publicly
- Fixed in
- v1.3.0+115 source tag; store rollout not independently verified
- Note
- Recovery activation and reactivation logged the generated mnemonic words; the import path also logged mnemonic content. The 16 July 2026 patch replaces recovery log values with a fixed message and changes import logging to a word count rather than the words. The change is present in tag v1.3.0+115. Exposure depends on the relevant logging path being active and someone gaining access to its output. The fix removes these disclosures from future log events; it does not erase old logs, establish compromise of every wallet, or prove that a particular store-distributed binary has been updated. Public-source review does not establish vendor attribution, an assigned severity or a fresh end-to-end retest.
F-PROTON-WALLET-FLUTTER-001: Secret handling. Mnemonic material is copied from recovery/import processing into diagnostic logs. Reviewed 26 Sep 2026. Mechanism assessed by 1seal.
Mechanism source for F-PROTON-WALLET-FLUTTER-001
Security area (1seal assessment): Confidentiality. Mnemonic material is copied from recovery/import processing into diagnostic logs. Reviewed 26 Sep 2026.