- Hacken
- Audits
- devolvedai
- [L1] Argochain | Pallets and Runtime | Oct2024
Audit name:
[L1] Argochain | Pallets and Runtime | Oct2024
Date:
Nov 4, 2024
Table of Content
Introduction
We express our gratitude to the DevolvedAI team for the collaborative engagement that enabled the execution of this Blockchain Protocol Security Assessment.
ArgoChain-SDK is specifically designed for developers eager to explore and innovate within the ArgoChain ecosystem.
Document | |
|---|---|
| Name | Blockchain Protocol Review and Security Analysis Report for DevolvedAI |
| Audited By | Tanuj Soni, Hamza Sajid |
| Approved By | Nino Lipartiia |
| Website | https://devolvedai.com→ |
| Changelog | 28/10/2024 - Preliminary Report |
| Changelog | 04/11/2024 - Second Preliminary Report |
| Platform | Argochain |
| Language | Rust |
| Tags | Substrate, EVM |
| Methodology | https://hackenio.cc/blockchain_methodology→ |
Document
- Name
- Blockchain Protocol Review and Security Analysis Report for DevolvedAI
- Audited By
- Tanuj Soni, Hamza Sajid
- Approved By
- Nino Lipartiia
- Website
- https://devolvedai.com→
- Changelog
- 28/10/2024 - Preliminary Report
- Changelog
- 04/11/2024 - Second Preliminary Report
- Platform
- Argochain
- Language
- Rust
- Tags
- Substrate, EVM
- Methodology
- https://hackenio.cc/blockchain_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/Devolved-AI/Argochain→ |
| Commit | b35c4375d7a54adfea81a270d85c72056caaa94e |
Review Scope
- Commit
- b35c4375d7a54adfea81a270d85c72056caaa94e
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
The documentation for the pallets inherited from the Frontier project → is adequate.
The README file would benefit from including a comprehensive system overview of the repository.
Code quality
The pallets exhibit strong code quality, drawing from the well-established standards of the Frontier project →.
Updates to both the Frontier and Substrate versions are necessary to align with recent changes.
Some tests and benchmarks are currently failing, suggesting the need for further improvement.
The presence of TODO comments in the codebase indicates areas that require additional attention.
Architecture quality
Leveraging the Substrate framework as the foundational infrastructure enhances the system's robustness and reliability.
The EVM integration is effectively achieved through the use of well-established and widely recognized pallets.
The runtime implementation comprehensively incorporates EVM-related pallets.
System Overview
The audit examines the integration of the EVM functionality into Argochain, covering three key pallets: pallet-ethereum, pallet-evm, and pallet-evm-chain-id, along with the associated runtime configuration.
These pallets are primarily based on the Frontier → project's implementation, with Argochain introducing only minor adjustments. The commits that introduce changes to these pallets (excluding modifications to the runtime) are outlined below.
This initial commit adds the pallets within the
framefolder, mirroring the Frontier implementation around commit hash1b03f49b98b8255ba75d93f243061752589dd457→.
Introduces the
mutate_balancefunction, which is utilized exclusively outside the scope of the audit inpallet-counter.
Adds multiple functions to the EVM pallet, though these additions are not invoked elsewhere in the codebase.
Contains sections of code that are commented out.
Enhances the formatting of the
evmpallet for better readability.
Following the review of the modifications applied to these pallets, it can be concluded that there have been no significant alterations since their initial adaptation from the Frontier project's implementation. The changes introduced by Argochain are largely minimal, indicating a commitment to preserving the original architectural integrity.
Risks
Scope Definition and Security Guarantees: The audit does not cover all code in the repository. Components outside the audit scope may introduce vulnerabilities, potentially impacting the overall security due to the interconnected nature of protocols.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-6651 | Vulnerable Dependencies and Outdated Substrate Version | accepted | High | |
| F-2024-6720 | Centralization Threat and Reward Imbalance Due to Era Payout Mechanism | accepted | High | |
| F-2024-6825 | Deficiencies in Gas Estimation Improvements | fixed | Medium | |
| F-2024-6663 | Incomplete EIP-3607 Implementation Allows Mempool Pollution | fixed | Low | |
| F-2024-6770 | Compilation Error When Enabling Runtime Benchmarks | accepted | Low | |
| F-2024-6827 | Inconsistent Refund Calculations | fixed | Low | |
| F-2024-6660 | Code Quality Warnings Highlighted in Static Analysis | accepted | Observation | |
| F-2024-6813 | Unit and Benchmark Test Failures | fixed | Observation | |
| F-2024-6801 | Unnecessary Inclusion of pallet_pov in the Runtime | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required. |
High | High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category. |
Medium | Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively. |
Low | Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system. |
Severity
- Critical
Description
- Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required.
Severity
- High
Description
- High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category.
Severity
- Medium
Description
- Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively.
Severity
- Low
Description
- Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system.
Appendix 2. Scope
The scope of the project includes the following components from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/Devolved-AI/Argochain→ |
| Commit | b35c4375d7a54adfea81a270d85c72056caaa94e |
Scope Details
- Commit
- b35c4375d7a54adfea81a270d85c72056caaa94e
Components in Scope
The audit covers the implementation of three specific pallets, as well as the associated runtime configuration. The components under review are:
frame/ethereum
frame/evm-chain-id
frame/evm
runtime