"Internet Computer: Security Assessment" by Trail of Bits (third-party security audit)

Developers
1

Summary

Trail of Bits (Trail of Bits | About), is a highly-rated cybersecurity research and consulting firm which has done security audits of dozens of blockchains. In March - May 2021, Trail of Bits and the DFIITY Foundation worked together to audit the code and address security issues. Please note: four high-severity issues were found and have fixed as detailed in the report (page 6).

The outcome of this collaboration is detailed in the 49-page report below:

Internet Computer Security Assessment: publications/DFINITY.pdf at master · trailofbits/publications · GitHub

Reviews like this are very important for both improving security and trust of the network. DFINITY team is very grateful for the hard work by the Trail of Bits folks!

Discussion leads

The person at DFINITY who was most involved and can best answer questions is @robin-kunzler of the DFINITY Crypto team.

Best way to read this report

  • For those with limited time, I recommend reading the Executive Summary (page 3- 6) or the color-coded Code Maturity Evaluation (page 9 -11) which give the reader a high-level view of the issue.
  • For those interested in understanding the issues, the report shows the associated Rust code.

Areas of the code which were audited:

  1. Internet Computer Interfaces
  2. Consensus Layer
  3. Network Nervous System
  4. Ledger Canister
  5. Governance Canister
  6. Registry Canister
  7. Cycles Minting Canister
  8. Genesis Token Canister
  9. Cryptography libraries
  10. Execution Environment
  11. P2P Layer
  12. Third Party Dependencies
  13. Hardware Wallet

Industry Background

18 Likes
2

THANK YOU!!! Can’t WAIT to read it!!!

5 Likes
3

Is there a plan to review the consensus algorithm more rigorously? It would be great to have multiple 3rd parties verify the chain key implementation since it is the most critical part of the system.

2 Likes
4

Good question.

Team is currently in process of another third party security review of Consensus and other components. We are planning to make these public too.

We are also planning a threshold ECDSA review and more reviews throughout the year.

The upcoming reports we publish will probably be more focused on specific features / components because one big lesson we learned is that smaller reviews tend to be more manageable, faster, and easier to publish. I think it is reasonable to expect multiple of these reports in 2022 across multiple components.

Without going into specifics, yes, the plan is to work with multiple security firms as well. I am being overly deliberately vague and careful (perhaps too much) here because I want to make sure I don’t accidentally leak anything our partners may not want us to. This is my own discretion, they likely may not care, but I rather be safe than sorry.

@robin-kunzler may correct anything I said above, of course. He is the true expert and point person within Crypto team.

6 Likes
5

Dream come true, thanks DFINITY.

3 Likes
6

Thanks @diegop !

The summary is accurate. The teams are currently working on fixes for some findings that were uncovered in the recent third party reviews and we will work towards making these reports public as well.

4 Likes