# "Internet Computer: Security Assessment" by Trail of Bits (third-party security audit) **URL:** \ **Category:** Developers\ **Created:** [January 5, 2022, 1:02am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113 "2022-01-05T01:02:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![diegop](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/diegop/32/569_2.png) [@diegop](https://forum.dfinity.org/u/diegop)\ **Post date:** [January 5, 2022, 1:02am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/1 "2022-01-05T01:02:33Z")
## Summary Trail of Bits ([About - Trail of Bits](https://www.trailofbits.com/about)), is a highly-rated cybersecurity research and consulting firm which has done security audits of dozens of blockchains. In March - May 2021, Trail of Bits and the DFIITY Foundation worked together to audit the code and address security issues. Please note: four high-severity issues were found and have fixed as detailed in the report (page 6). The outcome of this collaboration is detailed in the 49-page report below: Internet Computer Security Assessment: [publications/reviews/DFINITY.pdf at master · trailofbits/publications · GitHub](https://github.com/trailofbits/publications/blob/master/reviews/DFINITY.pdf) Reviews like this are very important for both improving security and trust of the network. **DFINITY team is very grateful for the hard work by the Trail of Bits folks!** ## Discussion leads The person at DFINITY who was most involved and can best answer questions is @robin-kunzler of the DFINITY Crypto team. ## Best way to read this report - For those with limited time, I recommend reading the Executive Summary (page 3- 6) or the color-coded Code Maturity Evaluation (page 9 -11) which give the reader a high-level view of the issue. - For those interested in understanding the issues, the report shows the associated Rust code. ## Areas of the code which were audited: 1. Internet Computer Interfaces 2. Consensus Layer 3. Network Nervous System 4. Ledger Canister 5. Governance Canister 6. Registry Canister 7. Cycles Minting Canister 8. Genesis Token Canister 9. Cryptography libraries 10. Execution Environment 11. P2P Layer 12. Third Party Dependencies 13. Hardware Wallet ## Industry Background - For context, you can see other reports by Trail of Bits here: [GitHub - trailofbits/publications: Publications from Trail of Bits](https://github.com/trailofbits/publications/) ---
**Author:** ![weedpatch2](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/weedpatch2/32/3385_2.png) [@weedpatch2](https://forum.dfinity.org/u/weedpatch2)\ **Post date:** [January 5, 2022, 2:55am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/2 "2022-01-05T02:55:38Z")
THANK YOU!!! Can’t WAIT to read it!!! ---
**Author:** ![everhusk](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/everhusk/32/404_2.png) [@everhusk](https://forum.dfinity.org/u/everhusk)\ **Post date:** [January 7, 2022, 1:13am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/3 "2022-01-07T01:13:53Z")
Is there a plan to review the consensus algorithm more rigorously? It would be great to have multiple 3rd parties verify the chain key implementation since it is the most critical part of the system. ---
**Author:** ![diegop](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/diegop/32/569_2.png) [@diegop](https://forum.dfinity.org/u/diegop)\ **Post date:** [January 7, 2022, 3:36am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/4 "2022-01-07T03:36:08Z")
Good question. Team is currently in process of another third party security review of Consensus and other components. We are planning to make these public too. We are also planning a threshold ECDSA review and more reviews throughout the year. The upcoming reports we publish will probably be more focused on specific features / components because one big lesson we learned is that smaller reviews tend to be more manageable, faster, and easier to publish. I think it is reasonable to expect multiple of these reports in 2022 across multiple components. Without going into specifics, yes, the plan is to work with multiple security firms as well. I am being overly deliberately vague and careful (perhaps too much) here because I want to make sure I don’t accidentally leak anything our partners may not want us to. This is my own discretion, they likely may not care, but I rather be safe than sorry. @robin-kunzler may correct anything I said above, of course. He is the true expert and point person within Crypto team. ---
**Author:** ![lastmjs](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/lastmjs/32/3406_2.png) [@lastmjs](https://forum.dfinity.org/u/lastmjs)\ **Post date:** [January 7, 2022, 3:45am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/5 "2022-01-07T03:45:50Z")
Dream come true, thanks DFINITY. ---
**Author:** ![robin-kunzler](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/robin-kunzler/32/3249_2.png) [@robin-kunzler](https://forum.dfinity.org/u/robin-kunzler)\ **Post date:** [January 7, 2022, 9:16am UTC](https://forum.dfinity.org/t/internet-computer-security-assessment-by-trail-of-bits-third-party-security-audit/10113/6 "2022-01-07T09:16:02Z")
Thanks @diegop ! The summary is accurate. The teams are currently working on fixes for some findings that were uncovered in the recent third party reviews and we will work towards making these reports public as well.