Introduction
We express our gratitude to the Kaia team for the collaborative engagement that enabled the execution of this Security Assessment.
Kaia is a Layer 1 blockchain platform that strategically targets both public and enterprise-level applications. Built on the foundation of the Ethereum protocol, Kaia incorporates innovative features and enhancements specifically designed to address practical challenges such as transaction validation times and fees. These enhancements make Kaia particularly well-suited for supporting emerging sectors such as gaming, decentralized finance (DeFi), and payment systems. One of Kaia's significant advantages is its compatibility with the Ethereum ecosystem, enabling the use of established Ethereum tools. This compatibility fosters extensive adoption by creators and developers, leveraging the robust infrastructure and widespread support of the Ethereum network to enhance functionality and user experience.
| title | content |
|---|---|
| Platform | Kaia |
| Language | Go |
| Tags | Layer 1, Service Chain |
| Timeline | 12/03/2024 - 26/04/2024 |
| Methodology | Blockchain Protocol and Security Analysis Methodology→ |
Review Scope | |
|---|---|
| Repository | https://github.com/kaiachain/kaia→ |
| Commit | 4831f49bbab1f0043ab45195ffc90bc054046bfb |
Review Scope
- Repository
- https://github.com/kaiachain/kaia→
- Commit
- 4831f49bbab1f0043ab45195ffc90bc054046bfb
Audit Summary
10/10
9/10
9/10
9/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Blockchain Protocol Code Review and Security Analysis Report for Kaia |
| Audited By | Sofiane Akermoun |
| Aubited By | Nino Lipartiia |
| Audited By | Nataliia Balashova |
| Approved By | Sofiane Akermoun |
| Website | https://kaia.io/→ |
| Changelog | 19/04/2024 - Preliminary Report |
| Changelog | 26/04/2024 - Final Report |
| Changelog | 08/05/2024 - Rename Project name to Kaia |
Document
- Name
- Blockchain Protocol Code Review and Security Analysis Report for Kaia
- Audited By
- Sofiane Akermoun
- Aubited By
- Nino Lipartiia
- Audited By
- Nataliia Balashova
- Approved By
- Sofiane Akermoun
- Website
- https://kaia.io/→
- Changelog
- 19/04/2024 - Preliminary Report
- Changelog
- 26/04/2024 - Final Report
- Changelog
- 08/05/2024 - Rename Project name to Kaia
System Overview
Kaia is a Layer 1 blockchain derived from the Geth codebase, which is the Go implementation of the Ethereum protocol. This foundation has been expanded with several notable features to enhance performance and functionality:
Enhanced Fee Structure: Kaia has implemented modifications to the transaction fee system to optimize costs and efficiency, making it particularly effective for high-throughput applications like gaming, DeFi, and payment systems.
Consensus Mechanism: Kaia uses the Istanbul Byzantine Fault Tolerance (IBFT) consensus algorithm, which is adapted from the Quorum protocol. This consensus mechanism is designed to improve transaction confirmation times and enhance network integrity while reducing the susceptibility to certain types of security threats.
Ethereum Compatibility: Kaia maintains strong compatibility with the Ethereum ecosystem, supporting the use of existing Ethereum tools and DApps.
Advanced Account System: Implements a sophisticated account system that decouples key pairs from addresses. This separation enhances security and flexibility in managing identities and permissions on the blockchain.
Innovative Architecture Design: Kaia features a unique architecture that separates its components for specialized functions. This includes the CoreCell network, designed for consensus and blockchain operations, and the EndPoint network, which handles user interactions and external connections, enhancing scalability and performance.
Executive Summary
Documentation quality
The total Documentation Quality score is 9 out of 10.
Source code documentation is inherited from the Geth project, ensuring robust foundational understanding and continuity.
Kaia-specific features and changes are well documented, highlighting the unique aspects of the platform.
Comprehensive online documentation of the protocol and Kaia Improvement Proposals is readily available.
Detailed documentation is provided for Kaia builders and node operators, supporting their engagement and operations.
Inherits all the resources and documentation of the Ethereum ecosystem by default, leveraging a vast pool of tools and community knowledge.
Code quality
The total Code Quality score is 9 out of 10.
Inherits Geth code quality, with added features adhering to the same high standards.
Adheres to the highest best practices of Go programming, ensuring robust and efficient code.
Maintains code coverage that aligns with industry standards, ensuring reliability and maintainability.
Well-managed code contributions and release processes through GitHub, facilitating effective version control and collaboration.
Remaining TODO comments in code.
Architecture quality
The total Architecture Quality score is 9 out of 10.
Based on the Geth source code, providing a solid and reliable foundation.
Features an innovative architecture design that separates components for different purposes, including the CoreCell network and EndPoint network.
Integrates the IBFT consensus mechanism based on the Quorum protocol, enhanced with updates and fixes tailored to meet specific use cases and requirements.
Security score
Upon auditing, the code was found to contain 1 critical, 1 high, 2 medium, and 3 low severity issues. All identified issues were fixed by Kaia team leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's blockchain protocol yields an overall score of 9.7. This score reflects the combined evaluation of documentation, code quality, architecture quality, and security aspects of the project.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-1699 | Critical Vulnerabilities in Go Standard Library | fixed | Critical | |
| F-2024-1765 | Inadequate Validation of Message Payload Signer | fixed | High | |
| F-2024-1355 | Node Unresponsiveness Caused by Synchronous Transaction Pool Event Processing | fixed | Medium | |
| F-2024-1973 | Outdated Consensus Implementation | fixed | Medium | |
| F-2024-2178 | Insecure Storage of BLS Secret Keys | fixed | Low | |
| F-2024-2161 | Key Duplication Vulnerability During Concurrent Imports | fixed | Low | |
| F-2024-1764 | Deprecated Elliptic Curve Cryptography | fixed | Low | |
| F-2024-2177 | Flawed UUID Processing in Keystore Implementation | fixed | Observation | |
| F-2024-2111 | Account Key Comparison Concerns | accepted | Observation | |
| F-2024-2071 | Suboptimal Architecture Regarding TxInternalData Interface | accepted | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required. |
High | High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category. |
Medium | Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively. |
Low | Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system. |
Severity
- Critical
Description
- Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required.
Severity
- High
Description
- High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category.
Severity
- Medium
Description
- Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively.
Severity
- Low
Description
- Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system.
Appendix 2. Scope
The scope of the project includes the following components from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/kaiachain/kaia→ |
| Commit | 4831f49bbab1f0043ab45195ffc90bc054046bfb |
Scope Details
- Repository
- https://github.com/kaiachain/kaia→
- Commit
- 4831f49bbab1f0043ab45195ffc90bc054046bfb
Components in Scope
Consensus
Implementation review (Istanbul BFT modifications)
Attack scenarios analysis (liveness, finality, eclipse, double spend, etc.)
Runtime/VM
VM implementation/changes review
Chain
Tx and account implementation review (defaults, timestamps, assembly)
Governance scheme/implementation review
Reward distribution scheme/implementation review
P2P/RPC
Implementation/changes review