coindesk.com
Solflare, a wallet app for the Solana blockchain, said it will make up the rewards its users missed after a problem at an outside company knocked its staking validator offline with about $160 million worth of $SOL ($SOL) sitting on it.
Staking allows $SOL token holders to earn a yield. They assign their tokens to a validator, a computer that helps check transactions and keep Solana’s records, and collect a share of the rewards as long as that validator keeps doing its job. Solflare runs its own validator so users can stake without leaving the app.
On Tuesday evening U.S. time, Solflare said the company it pays to run that validator reported “a security incident on their side, affecting the keys they hold for the Solflare validator.”
Solflare didn’t identify the company. The validator stopped earning, and about 1.56 million $SOL was still delegated to it on Wednesday afternoon, Stakewiz data shows.
The coins themselves are safe. Staked $SOL “sits in your own stake account and is controlled by your keys alone,” Solflare said, and “no user funds were touched.” Whoever holds a validator’s keys can stop it from earning, but can’t withdraw anyone’s stake.
Users lose the rewards for now. They also discovered that, despite being branded as Solflare’s, the validator had been run by another company all along.
Moving out
Solflare said Wednesday that a replacement validator is live and that it will cover missed rewards for everyone who moves to it. Users can start by choosing regular unstaking from “Solflare (Legacy)” and then staking with the new validator, or wait for an app update that will walk them through it.
The switch isn’t instant, however, as a stake changes only take effect at the end of each epoch — a period of roughly two days on Solana — meaning the old stake has to wind down before the new one starts earning.
A mass migration is also an opening for scammers. Solflare said the move will happen only inside its app, and that it will never message users directly or send them a link about it.
