[Security] Critical vulnerability in backup encryption — requesting private disclosure channel

[0xFFFForge]

Hi Flow Wallet team,

I'm a security researcher. During a review of the Flow Reference Wallet Chrome extension (currently distributed on Chrome Web Store), I identified multiple critical cryptographic vulnerabilities in the Google Drive backup encryption implementation.

These issues allow offline extraction and brute-force decryption of wallet private keys from cloud backups with minimal computational cost.

Severity: 2× Critical, 1× High
Affected component: Backup encryption (Google Drive cloud backup feature)
Status: Verified with working PoC against the production Chrome Web Store build (v2.9.4)

I do NOT want to disclose details publicly. The HackenProof bug bounty program for Flow Wallet is currently closed (83 days until reopening), and this repository has no SECURITY.md or private vulnerability reporting enabled.

Could you please provide a secure channel (email, private advisory, or similar) so I can share the full report and proof-of-concept?

Thank you.

@zzggo @lmcmz @caosbad

[zenabot27]

@HBINNNNNN could you email me ?
hao.fu@flowfoundation.com

[0xFFFForge]

Hi @lmcmz, thanks for responding!

I tried emailing hao.fu@flowfoundation.com but got a 550 5.1.1 bounce — that address doesn’t seem to exist.

Could you share a working email address? Happy to send the full report and PoC through a secure channel.

[JeffreyDoyle]

Hey @HBINNNNNN -- Thank you, please feel free to email me: jeffrey.doyle@flowfoundation.org

[0xFFFForge]

Hi @JeffreyDoyle,

I sent you a detailed email on March 10 per your request. It's been over two weeks with no response.

I understand these things take time internally, but I'd appreciate at least an acknowledgment that my email was received and the disclosure is being reviewed.

The 90-day coordinated disclosure window is running. I'd like to keep this cooperative -- just need someone on your side to engage.

Thanks.

[zhaog100]

/attempt

[zhaog100]

/attempt