Audit name:
[L1] Xphere | xchain | Feb2025
Date:
Mar 3, 2025
Table of Content
Introduction
We express our gratitude to the Xphere team for the collaborative engagement that enabled the execution of this Blockchain Protocol Security Assessment.
Xphere revolutionizes blockchain technology by addressing the trilemma of scalability, security, and decentralization through an innovative dual-chain architecture. By combining a PBFT-based Main Chain for efficient and rapid transaction processing with a PoW-based Proof Chain for secure validator selection, Xphere achieves an optimized balance of trust, performance, and decentralization. This ecosystem fosters innovation, accessibility, and sustainability for individuals, developers, and enterprises worldwide.
Document | |
|---|---|
| Name | Blockchain Protocol Review and Security Analysis Report for Xphere |
| Audited By | Reza Mir |
| Approved By | Nino Lipartiia |
| Website | https://x-phere.com/→ |
| Changelog | 27/02/2025 - Preliminary Report |
| 03/03/2025 - Second Preliminary Report | |
| 04/03/2025 - Final Report | |
| Platform | Xphere |
| Language | Golang |
| Tags | Layer 1, Dual-Chain Architecture |
| Methodology | https://hackenio.cc/blockchain_methodology→ |
Document
- Name
- Blockchain Protocol Review and Security Analysis Report for Xphere
- Audited By
- Reza Mir
- Approved By
- Nino Lipartiia
- Website
- https://x-phere.com/→
- Changelog
- 27/02/2025 - Preliminary Report
- 03/03/2025 - Second Preliminary Report
- 04/03/2025 - Final Report
- Platform
- Xphere
- Language
- Golang
- Tags
- Layer 1, Dual-Chain Architecture
- Methodology
- https://hackenio.cc/blockchain_methodology→
Review Scope | |
|---|---|
| Repository | https://github.com/xpherechain/xpherechain→ |
| Commit | 69e016e9787591721164140a3ce10baf76bbdd1a |
Review Scope
- Commit
- 69e016e9787591721164140a3ce10baf76bbdd1a
Audit Summary
The system users should acknowledge all the risks summed up in the risks section of the report
Documentation quality
The whitepaper and website documentation are well-structured and comprehensive.
Adding more in-code comments and logs would enhance traceability, making it easier to track updates and modifications.
Code quality
The codebase follows Go programming best practices, ensuring maintainability and efficient performance.
Several areas contain deprecated or unused code, which should be reviewed and removed to enhance clarity and maintainability.
Architecture quality
The project is based on a well-known and stable codebase.
The overall architecture is well-designed, ensuring reliability and scalability.
Test coverage
The project lacks automated testing, including unit tests, integration tests, and end-to-end tests.
System Overview
Xphere is a public blockchain project designed to lead the meta-revolution by establishing an ecosystem participation foundation initially, respecting the participation and contributions of the entire community, and aggregating new technologies and service innovations as a practical blockchain commercialization layer.
The Xphere blockchain features a Dual-Chain Architecture consisting of the Main Chain and the Proof Chain.
The Main Chain ensures security and decentralization through a robust PoW consensus mechanism, while the Proof Chain prioritizes scalability and efficient transaction processing. By dividing the roles between the two chains, this architecture achieves a balance of trust and efficiency.
Risks
The project is primarily a fork of the Kaia chain, with most modifications focused on rebranding and offering limited technical differentiation.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2025-8878 | Vulnerable Dependencies | accepted | Medium | |
| F-2025-8996 | Testing Practices | accepted | Observation | |
| F-2025-8953 | Code Quality Improvement | accepted | Observation |
Appendix 1. Severity Definitions
Severity | Description |
|---|---|
Critical | Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required. |
High | High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category. |
Medium | Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively. |
Low | Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system. |
Severity
- Critical
Description
- Vulnerabilities that can lead to a complete breakdown of the blockchain network's security, privacy, integrity, or availability fall under this category. They can disrupt the consensus mechanism, enabling a malicious entity to take control of the majority of nodes or facilitate 51% attacks. In addition, issues that could lead to widespread crashing of nodes, leading to a complete breakdown or significant halt of the network, are also considered critical along with issues that can lead to a massive theft of assets. Immediate attention and mitigation are required.
Severity
- High
Description
- High severity vulnerabilities are those that do not immediately risk the complete security or integrity of the network but can cause substantial harm. These are issues that could cause the crashing of several nodes, leading to temporary disruption of the network, or could manipulate the consensus mechanism to a certain extent, but not enough to execute a 51% attack. Partial breaches of privacy, unauthorized but limited access to sensitive information, and affecting the reliable execution of smart contracts also fall under this category.
Severity
- Medium
Description
- Medium severity vulnerabilities could negatively affect the blockchain protocol but are usually not capable of causing catastrophic damage. These could include vulnerabilities that allow minor breaches of user privacy, can slow down transaction processing, or can lead to relatively small financial losses. It may be possible to exploit these vulnerabilities under specific circumstances, or they may require a high level of access to exploit effectively.
Severity
- Low
Description
- Low severity vulnerabilities are minor flaws in the blockchain protocol that might not have a direct impact on security but could cause minor inefficiencies in transaction processing or slight delays in block propagation. They might include vulnerabilities that allow attackers to cause nuisance-level disruptions or are only exploitable under extremely rare and specific conditions. These vulnerabilities should be corrected but do not represent an immediate threat to the system.
Appendix 2. Scope
The scope of the project includes the following components from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/xpherechain/xpherechain→ |
| Commit | 69e016e9787591721164140a3ce10baf76bbdd1a |
| Whitepaper | https://docs.x-phere.com/whitepaper/→ |
Scope Details
- Commit
- 69e016e9787591721164140a3ce10baf76bbdd1a
- Whitepaper
- https://docs.x-phere.com/whitepaper/→
Components in Scope
Assessment of All Modifications: A comprehensive review of all changes introduced since forking Kaia.
Security Patch and Update Analysis: Identification of missing security patches and updates that have been released for Kaia post-fork but have not been incorporated into the forked version.