We’ve just made the Neutron repository public https://github.com/infu/neutron to help increase the security of Motoko libraries when used.
It has some interesting mechanisms that improve security. Perhaps @ZenVoich could integrate them inside mops.
Something like mops audit could do what our in-house npm modules do. https://github.com/infu/neutron/blob/main/SECURITY.md Longer version of this post including Neutron related security.
Additionally, mops seem to be on-chain and it could become a DAO? a DAO package manager could be beneficial.
Then we could just make our DAO Neutrinite the owner of our mops packages. Mops can already assign the DAO as an owner, but Mops also has to be a DAO for this whole thing to make sense.
Feel free to take any code you want from the repo.
How the security of Neutron works
We are scanning all 3rd party app code for various things they shouldn’t use directly.
There are two scans, one is text-based, another is AST based. (Pretty much denies creating actors and running functions that are named setCertifiedData, cyclesAdd, and so on.)
It scans all libraries an app imports including the base libraries.
One of the problems is, there are two modules inside the base library that provide allowed functionality but trigger the security checks. These are “Principal.mo” and “Random.mo”.
So we’ve whitelisted their hashes from the last 23 Motoko base releases.
Unless there is a way for Motoko code to jailbreak that I don’t know of, I suppose this should work?
Text checks:
AST checks (Text checks basically help us find out if the AST checks are correct):
Developers get notified when they use prohibited code. That’s what mops audit could print.
These say ‘disallowed’ because Neutron is supposed to provide an API for the functionality, but if placed inside mops, they could just notify the developer what security-critical functions a library is using.
I will think about integrating it into Mops. Can you publish it as an npm package?