Key insights from 100 security audits | Jon Stephens | Hack Seasons Bangkok

Summary

In this presentation, John, CEO of Paradise, shares insights from over 100 security audits, focusing on vulnerabilities in blockchain and zero-knowledge (ZK) protocols. Key findings include that ZK protocols are twice as likely to contain critical issues compared to non-ZK protocols, with logical errors, data validation flaws, and under-constrained ZK circuits being the most common vulnerabilities. John emphasizes the importance of thorough testing and professional audits to mitigate risks, highlighting real-world examples like the Nomad Bridge hack and Tornado Cash's near-exploit. The presentation stresses that robust audits and testing are essential for securing protocols against potential exploits.

Takeaways

• 😀 ZK Protocols are twice as likely to contain critical bugs compared to non-ZK protocols, with 55% of ZK audits showing at least one critical bug.
• 😀 Non-ZK audits have a lower rate of critical issues, with only 27% of them containing critical bugs.
• 😀 Logical errors are the most common issue found in security audits, especially those related to business logic implementation.
• 😀 Maintainability issues, while not always severe, are common and can lead to problems down the line, like using 'magic numbers' in code.
• 😀 Data validation errors occur when user inputs aren't properly checked, potentially causing undefined or unexpected behaviors.
• 😀 Denial of Service (DoS) issues can lock protocols or services in a state that they can't recover from, breaking the user experience.
• 😀 The most severe audit issues include logical errors, data validation errors, and under-constrained ZK circuits.
• 😀 Under-constrained ZK circuits allow attackers to manipulate data in unexpected ways by providing incorrect proof inputs.
• 😀 Real-world vulnerabilities like the Nomad Bridge hack and Tornado Cash exploit highlight the dangers of inadequate data validation and logic flaws.
• 😀 To mitigate security risks, thorough testing and professional security audits are essential to prevent exploits from making it into production.

Q & A

What is the key difference in critical bug frequency between ZK Protocols and non-ZK Protocols based on Aradise's audit data?

ZK Protocols are found to be twice as likely to contain a critical bug compared to non-ZK Protocols. Specifically, 55% of ZK audits have at least one critical issue, while only 27% of non-ZK audits do.

What are the five most common issues found during Aradise's security audits?

The five most common issues identified in security audits are: 1) Logical errors, 2) Maintainability issues, 3) Data validation issues, 4) Usability issues, and 5) Denial of service problems.

What is the impact of logical errors in a protocol according to the audit findings?

Logical errors are the most common and significant issue, as they directly affect the intended business logic of a protocol. These errors can cause protocols to malfunction, leading to potential exploitation by attackers.

Can you explain what maintainability issues are and how they can become problematic over time?

Maintainability issues are typically less severe but can turn into major problems as a protocol evolves. For example, the use of 'magic numbers' (arbitrary numbers hardcoded into the protocol) can cause issues if they need to be updated, leading to bugs if the change isn't applied consistently across the system.

What is a data validation issue, and how does it impact a protocol?

A data validation issue occurs when inputs are not properly validated, allowing users to provide unexpected or malicious data. This can result in undefined or unintended behavior, such as overflows or incorrect calculations, potentially causing exploits or protocol failures.

How do under-constrained ZK circuits pose a significant security risk?

Under-constrained ZK circuits allow attackers to manipulate the data in the witness (proof data) in ways the protocol doesn't expect. This can result in incorrect proofs being accepted, allowing attackers to exploit the protocol and perform unauthorized actions.

What is a denial of service (DoS) issue in the context of smart contracts, and why is it a significant threat?

A denial of service issue occurs when a protocol or smart contract enters a state that it cannot recover from, effectively rendering the protocol unusable for users. These issues can block access to funds or prevent protocol interactions, causing significant disruption.

What are access control issues, and how can they affect a protocol’s security?

Access control issues involve failures in restricting who can execute specific functions within a protocol. For example, if unauthorized users can access critical functions, they might be able to steal funds or compromise the protocol's integrity.

What are some real-world examples where logical and data validation errors caused major security breaches?

A notable example of a logical error causing a major security breach is the ERC-404 case, where users could mint funds by exploiting a flaw in the contract's balance update logic. A significant data validation issue occurred with the Nomad Bridge hack, where incorrect initialization allowed unauthorized users to submit valid messages, leading to the theft of assets.

How did Tornado Cash handle the under-constrained circuit issue, and what does this highlight about the importance of proactive security measures?

Tornado Cash discovered the under-constrained circuit issue in their protocol and exploited it themselves before any attackers could. This proactive response was crucial because it allowed them to secure the funds before launching an update to fix the vulnerability. It highlights the importance of thorough auditing and quick action in securing protocols.