jpg-store / vesting-contract Goto Github PK
View Code? Open in Web Editor NEWLicense: MIT License
License: MIT License
MLabs inspected the onchain and offchain code of the JPG Vesting Contract over a three week period and discovered two vulnerabilities and four recommendations. Additionally, MLabs has provided a testing framework and tests written to verify the claims made in the report (available on GitHub). This list is not exhaustive, as the team only had a limited amount of time to conduct the audit.
Analyse the offchain contracts for suspicious behaviour.
>= 4
. This is because unlock script expects only 2 signing key as input.Test the offchain shell scripts against the plutip cluster. #7
We could not conclude all the required tests prior to the end of audit, but a partial auditing of the offchain has not revealed any vulnerabilities. With this being said, some hypothesis remain untested, therefore we cannot make a clear statement on the non-existence of vulnerabilities in the offchain code.
The Audit revealed the following two Medium Severity
vulnerabilities:
Furthermore, the audit puts forward the following optimisations / recommendations:
Please note that as described in #10, only a partial audit of the offchain code was undertaken - not revealing any vulnerabilities.
For report brevity (and clarity), the testing framework and associated PRs will be mentioned here, and not included in the Audit Report. For in-depth explanation about what each PR is aiming to prove, please refer to the linked ticket description on GitHub.
Therefore, we would first mention the tickets outlining the hypotheses that the tests were trying to prove/disprove:
Secondly, we would like to mention the PRs proposing the tests to be integrated into the main repository.
We recommend for the aforementioned tests to be included in the main branch and made visible in the CI.
Severity | CVSS | Vulnerability type |
---|---|---|
None | 0.0 | None |
In the current version, we have to iterate the Portion
list multiple times to calculate the total unvested value:
Portion
from the given Schedule
amount
from the filtered Portion
Value
(s) present in the list.unvested :: Value
unvested = mconcat . fmap amount . filter (not . isVested) . schedule $ datum
The same thing can be accomplished using foldr
which only requires a single iteration of the list.
unvested :: Value
unvested = foldr (\ !portion !totalAmt ->
if isVested portion
then totalAmt
else mappend (amount portion) totalAmt
) mempty
. schedule $ datum
During the audit, MLabs Audit Team (from now on referred to as MLabs) have used the provided files for the following scope:
A. Audit the onchain contract
A.1. Integrate testing frameworks (Plutip and PSM) to allow reproducible testing of hypotheses.
A.2. Write tests to prove the well functioning of the on-chain components.
B. Audit of the offchain components
B.1. Test the well functioning of the provided shell scripts.
B.2. Audit the shell scripts for any malicious or not intended behaviour.
Please note that point B.1. is not marked as finished due to it being partially explored. For more information please refer to #10.
In response to the above scope, the Audit process took three (one week) sprints and it can be summarised to the following actions:
Review and test the onchain/offchain components against the MLabs Vulnerability types.
Write test scenarios for the implementations, and run some of them against a Cardano node (via Plutip).
Find optimisations, code quality improvements, or recommendations.
Capture the findings in an Audit Report.
MLabs analysed the validators and minting scripts from the github.com/jpg-store/vesting-contract repository starting at commit 703566b
.
The following checksums are those of files captured by commit 703566b
, and were generated using the following sha256 binary:
$ sha256sum --version
sha256sum (GNU coreutils) 9.0
The checksums are:
34ed...a6a6 app/Main.hs
6ef0...aa6c src/Canonical/Shared.hs
ee50...1886 src/Canonical/DebugUtilities.h
add6...b689 src/Canonical/Vesting.hs
INCLUDE CheckSum
The audit report is an aggregation of issue, tickets and pull-requests created in the jpg-store/vesting-contract repository.
To leverage a standardised metric for the severity of the open standard Common Vulnerability Scoring System, together with the NVD Calculator. The metrics from the mentioned tools were included with each vulnerability. MLabs recognises that some of the parameters are not conclusive for the protocol - but considers that leveraging such a standard is still valuable to offer a more unbiased severity metric for the found vulnerabilities.
The aforementioned CVSS calculations were then benchmarked using the CVSS-Scale metric, receiving a grade spanning from Low
to Critical
. This additional metric allows for an easier, human understandable grading, whilst leveraging the CVSS standardised format.
Severity | CVSS | Vulnerability type |
---|---|---|
None | 0.0 | incorrect-documentation |
Vesting contract uses Action
type as it's redeemer, this type has a single data constructor which is named Disburse
whose type is Disbure :: [PubKeyHash] -> Action
. We think that this name is misleading as the role of this redeemer is not only to disburse the value locked in the contract when the deadline has passed but also to update the current beneficiaries of the Input
datum. Hence, we think the option of updating beneficiaries should also be highlighted in the name of Action type's data constructor.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.