# Security Analysis of the Solo Firmware

Solo firmware accepted unordered duplicate chunk writes, letting an attacker point the version pointer at arbitrary bytes to downgrade to older signed firmware.

- Payout: Research
- Severity: high
- Program: SoloKeys
- Write-up by: Doyensec
- Disclosed: 2020-02-18
- Write-up quality: 7/10
- Original: https://blog.doyensec.com/2020/02/19/solokeys-audit.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-19-solokeys-audit-html
- Tags: area:devices domain:iot impact:integrity kind:research platform:research sev:high tech:rust technique:fuzzing technique:source-review vuln:business-logic vuln:signature-replay

**Target:** STM32-based Solo security key firmware update mechanism
**Root cause:** Firmware update writes chunks and updates last_written_app_address per write, but never enforces that chunks are written once and in ascending order, so the version pointer can be redirected into the middle of the firmware.
**Steps:**
1. Run firmware v3.0.1 on the key.
2. Take older signed firmware v3.0.0 and find four bytes in it that, interpreted as a version, exceed v3.0.1 (e.g. bytes encoding v3.0.37).
3. Send the whole v3.0.0 firmware to the key; last_written_app_address points to end encoding 3.0.0.
4. Re-write the four chosen bytes at their original mid-firmware location; last_written_app_address now points there and reads the fake higher version.
5. Version check passes and the older signed firmware is installed.
**How found:** Manual source code review of the firmware update path plus fuzzing; the reviewer noticed the version pointer is updated on every chunk write and that ordering/uniqueness of chunks was assumed but not enforced.
**Exploitation:** Attacker with physical access to the key, or a malicious site with explicit user acknowledgement on the WebAuthn window, uploads an older signed firmware by replaying chunks out of order to spoof the version pointer, then exploits known vulnerabilities in that older release. Signature verification is not bypassed; only prior signed releases can be installed.
**Escalation:** Downgrade to an older release to leverage previously patched vulnerabilities in that version.
**Insight:** When a parser or updater maintains a 'last written' pointer across incremental writes, check whether duplicate or out-of-order writes are rejected; a replayed chunk can relocate the pointer to attacker-chosen bytes that are then trusted as metadata like a version.