Out-of-the-Box Exploitation
Course
Guanxing Wen of CertiK presents a full compromise of the dGEN1 Ethereum phone - from BootROM misconfiguration and in-memory boot chain patching to private key extraction and pre-activation airdrop theft.
Crypto phones promise the convenience of a smartphone with the security of a hardware wallet - managing private keys in a trusted execution environment so digital assets never leave the secure boundary. The dGEN1, the first native Ethereum mobile device, makes exactly that claim. Starting from an unenforced authentication check in the MediaTek download mode, this research traces a full compromise from BootROM to application layer - without modifying physical flash storage.
In this session, led by Guanxing Wen of CertiK, you will learn:
- How a Loader-of-the-Loader in-memory patching strategy achieves EL3 code execution across the full MediaTek boot chain without triggering a factory reset;
- How boot-level compromise propagates into the credential path, enabling offline lock-screen brute-forcing and recovery of the wallet's primary ERC4337 signing key;
- How a separate identity flaw in the asset-claim workflow allows pre-activation theft of airdrop funds using identifiers printed on a sealed retail box.
Here is the course outline:
Out-of-the-Box Exploitation: Breaking the Trust Chain of the Ethereum Phone |
Completion
The following certificates are awarded when the course is completed:
 |
CPE Credit Certificate |
