Fortifying ZenGo: Unearthing and Defending Against Privileged User Attacks

CertiK's SkyFall team evaluated ZenGo's MPC wallet design and found a misimplementation in the device key enrollment API that allowed a privileged attacker who can extract the client's Master Key 2 and API token to register a new device key and perform transactions (the "Device Fork Attack"); ZenGo implemented server-side biometric enforcement to mitigate the issue and CertiK confirmed the patch.