Slow fog: Sentry service of Slope Wallet (Android, Version: 2.2.2) has private key leakage

According to the data provided by the Solana Foundation, about 60% of the stolen users use Phantom, about 30% use Slope, The rest use Trust Wallet, Coin98 Wallet, etc. IOS and Android are not immune. In analyzing Slope Wallet (Android, Version: 2.2.2), we found that it uses Sentry's services. Sentry is a widely used service that runs on "O7e.Slope [.] Finance". Sentry's service collects sensitive data like mnemonics and private keys from Slope wallets and sends it to https://o7e.slope[.] Finance/API /4/ Envelope /, It is found that the Sentry service in the Version:>=2.2.0 package collects mnemonics to send to "o7e.slope[.]finance", while Version:2.1.3 finds no obvious behavior for collecting mnemonics or private keys. Slope Wallet(Android, >= Version: 2.2.0) was released after 06/24/2022, so Slope users after that date are affected. For the other 60% of Phantom Wallet users, analysis of the Phantom (version: 22.07.11_65) Wallet revealed that the Phantom (Android, version: 22.07.11_65) also uses the Sentry service to collect user information, but so far has not found any obvious collection of mnemonics or private keys.