Critical Security Update for users of Magma for Android
on October 26, 2020
There is an important security update to the Android version of Magma mobile wallet that requires immediate user action.
We strongly recommend that users who created new wallets with Magma for Android on or before October 17 (v1.1.2 or earlier) upgrade to the latest version of the app immediately (v1.2.5 or later). The latest version of the app includes a wallet migration process that will generate a new wallet and recovery phrase, and transfer your balance from your old wallet to your new wallet. You can also opt out of the migration and choose to send your funds to another Tezos wallet address. Most Android users should consider this an urgent and mandatory update. Your funds are at risk, and time is critical. If you have any doubt about which version you used to create your wallet, you should upgrade. Users who created wallets on the iOS version of Magma are not affected.
Magma was audited by Trail of Bits on June 8, and we fixed all high-severity issues before releasing to the app stores. This is a high-severity issue that was missed by the audit. It was brought to our attention by Klas Harrysson, lead developer at Tezos Commons. Trail of Bits confirmed the seriousness of this issue, and we have worked with them to fix the issue in this most recent upgrade, and we have consulted with them on our migration strategy.
We will be posting more information about the security update and underlying issue after we’ve reached as many of our users as possible to complete their wallet migration.
Google Play Store app distributions roll out globally over a short period. This timing is beyond the control of app developers. As of this writing, the migration update is available in most areas. If you don’t see version 1.2.5 or later yet in the Play Store, the global rollout may still be in progress. You may immediately transfer your assets to another Tezos wallet until the new version becomes available in your area.
Please update your Magma app for Android and follow the migration process.
The Magma team at camlCase
PS. You can stay up to date with further announcements on Twitter.