Introduction
We express our gratitude to the Polymesh team for the collaborative engagement that enabled the execution of this Blockchain Protocol Security Assessment.
Polymesh is a Layer 1 blockchain specifically designed for security tokens, emphasizing compliance within regulated markets. It facilitates the issuance, transfer, and management of security tokens while ensuring adherence to regulatory standards.
Key features include identity verification mechanisms, governance frameworks, and compliance tools that enhance liquidity and create new funding opportunities for organizations. By prioritizing regulatory compliance and security, Polymesh aims to revolutionize the landscape of asset tokenization.
Document | |
|---|---|
| Name | Blockchain Protocol Review and Security Analysis Report for Polymesh |
| Audited By | Nino Lipartiia, Tanuj Soni, Hamza Sajid |
| Approved By | Luciano Ciattaglia |
| Website | https://polymesh.network/→ |
| Changelog | 16/10/2024 - Preliminary Report |
| Changelog | 31/10/2024 - Second Preliminary Report |
| Changelog | 13/11/2024 - Final Report |
| Platform | Polymesh |
| Language | Rust |
| Tags | Substrate, KYC, Decentralized ID |
| Methodology | https://hackenio.cc/blockchain_methodology→ |
Document
- Name
- Blockchain Protocol Review and Security Analysis Report for Polymesh
- Audited By
- Nino Lipartiia, Tanuj Soni, Hamza Sajid
- Approved By
- Luciano Ciattaglia
- Website
- https://polymesh.network/→
- Changelog
- 16/10/2024 - Preliminary Report
- Changelog
- 31/10/2024 - Second Preliminary Report
- Changelog
- 13/11/2024 - Final Report
- Platform
- Polymesh
- Language
- Rust
- Tags
- Substrate, KYC, Decentralized ID
- Methodology
- https://hackenio.cc/blockchain_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/PolymeshAssociation/polymesh→ |
| Commit | e5cc1de8208e6d3461b40b97ed5cf4338ad96010 |
Review Scope
- Commit
- e5cc1de8208e6d3461b40b97ed5cf4338ad96010
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
The protocol documentation is readily accessible on the official Polymesh website.
The README file provides comprehensive documentation on the build and testing processes.
The documentation within the codebase is sufficient, offering a solid understanding of the implemented functionalities.
Both the in-code documentation and the website require updates to align with the latest changes.
Code quality
The codebase adheres to the highest standards of quality in Rust programming.
The Substrate code consistently maintains a superior level of quality.
Benchmarking and weight management are effectively implemented; however, several pitfalls were identified during the audit process.
Test coverage is recognized as an area requiring improvement.
The codebase contains unresolved TODO comments, highlighting aspects that necessitate further attention.
Architecture quality
Polymesh utilizes the mature and widely adopted Substrate framework as the foundational infrastructure for its blockchain.
The codebase exhibits modularity by effectively organizing functionalities into Substrate pallets.
Interactions between pallets are concise and thoughtfully designed.
This modular approach facilitates the safe and efficient implementation of future features.
System Overview
Polymesh is a Layer 1 blockchain built on the Substrate framework, specifically designed for the issuance and management of security tokens. It integrates various components to achieve its objectives while retaining critical functionalities from the Substrate framework, particularly concerning regulatory compliance requirements like Know Your Customer (KYC) and Customer Due Diligence (CDD).
The audit focused on the changes implemented between Polymesh version 6 and version 7. Key modifications include:
Asset Management Enhancement: Assets are now distinguished by unique identifiers, replacing the previous reliance on Ticker, thereby improving asset management efficiency.
Staking Mechanism Updates: The staking system has been updated to align more closely with the latest Substrate Staking Pallet, enhancing its functionality while preserving essential features unique to Polymesh, such as Customer Due Diligence (CDD).
Multi-Signature Proposal Management Enhancements: Adjustments have been implemented to enhance the management of MultiSignature accounts, including improvements to proposal processes and the streamlining of identity and key-related operations.
Support for Mediators in Settlement Processes: An external party can now be included in the instruction, with their affirmation required for approval.
Risks
Several issues identified within the audit scope were not included in the report, as the Polymesh team implemented fixes independently. Notable updates include the weights implementation → and various migration fixes detailed here → and here →. These fixes were validated during the audit retesting phase.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2024-6616 | Benchmarking Gaps in Contract Instantiation Weight Calculation | fixed | Medium | |
| F-2024-6453 | Denial of Service Risk Due to Oversized PortfolioId Vectors | fixed | Medium | |
| F-2024-6030 | Vulnerable and Unmaintained Dependencies | mitigated | Medium | |
| F-2024-6615 | Insecure Arithmetic Practices Affecting Weight Calculations | fixed | Low | |
| F-2024-6557 | Weight Calculation Neglect of Portfolio Name Length | fixed | Low | |
| F-2024-6413 | Ticker Linking Mechanism Deficiency | fixed | Low | |
| F-2024-6148 | Insufficiencies in Admin Removal Mechanisms | fixed | Low | |
| F-2024-6037 | Inconsistent Proposal Handling When Changing Confirmation Requirements | fixed | Low | |
| F-2024-6556 | Restrict Self-Addition to AllowedCustodians | fixed | Observation | |
| F-2024-6494 | Inefficiency in Weight Calculation for Mediator Instruction Rejection | fixed | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required. |
High | High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category. |
Medium | Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively. |
Low | Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system. |
Severity
- Critical
Description
- Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required.
Severity
- High
Description
- High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category.
Severity
- Medium
Description
- Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively.
Severity
- Low
Description
- Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system.
Appendix 2. Scope
The scope of the project includes the following components from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/PolymeshAssociation/polymesh→ |
| Commit | e5cc1de8208e6d3461b40b97ed5cf4338ad96010 |
Scope Details
- Commit
- e5cc1de8208e6d3461b40b97ed5cf4338ad96010
Components in Scope
The audit encompasses the entire Polymesh → repository, with a particular emphasis on analyzing the modifications between versions 7 and 6 of Polymesh.