Bridge - RuneMine

Sharing code publicly or privately could lead to inadvertently leaving secrets in the code, making them accessible to others. Repositories are frequently cloned and forked into new projects, giving new developers access to their complete history. Any secrets within the repository's history would exist in all new repositories, and if stored in plain text, could lead to potential misuse of the secrets. In the case of a breach or unauthorized access to the source code, it could lead to further exploitation of infrastructure.

During the security assessment, it was identified that the application contained hardcoded (Private Keys, Mnemonics) into the test scripts and repository. While these test scripts may not be part of the production code, hardcoding secrets in any part of the codebase exposes them to anyone who has access to the repository also gives the attacker access to all previous history of commits. This practice can lead to unauthorized access to databases and services, resulting in potential data breaches and significant security risks, especially if the test scripts are mistakenly deployed or accessed by unauthorized personnel.

To address the identified risks, the following measures would be appropriate:

• Extracted hardcoded secrets from the source code and the repository's commit history.

• Changed and invalidated exposed secrets, replacing them with new, secure credentials.

• Employed environment variables, secret management solutions, or encryption for secure secret storage and management.

• Established access controls to ensure that repositories remained private and only accessible to authorized personnel.

Remediation Plan

SOLVED: The RuneMine team solved the issue by removing the identified secrets, and further confirmed that the identified secrets were used in a test environment.

During the assessment, a risk has been identified to the security of the bridge, where in the bridge repository where sensitive information, such as blockchain bridge secrets, are stored in a .env file. While using environment variables is generally a good practice, storing sensitive information in a .env file poses a risk if the file is not properly protected. The .env file can be accidentally committed to version control systems, exposed through improper file permissions, or accessed by unauthorized users. Given the sensitivity of blockchain bridge secrets, it is crucial to ensure they are stored and managed securely.

The presence of sensitive information in a .env file can lead to unauthorized access to blockchain bridge secrets. An attacker who gains access to these secrets can manipulate transactions, access blockchain assets, and potentially compromise the entire bridge network. This can result in significant financial loss, data breaches, and operational disruption.

func main() {
	err := godotenv.Load()
	if err != nil {
		log.Info("Error loading .env file")
	}

It is recommended to use GitHub Secrets to securely store and manage sensitive information. GitHub Secrets allows you to store and manage secrets at the repository level, ensuring they are encrypted and only accessible by authorized workflows.

Remediation Plan

SOLVED: The RuneMine team solved the issue by removing the dotenv dependency.

The appendChangeTxOut function in the Bitcoin transaction handling system is responsible for calculating the change in satoshis after a transaction and appending outputs to a transaction. The function lacks proper validation checks for the calculated changeSatoshis, and does not consider the possibility of integer underflow, which can occur when the inputSatoshis is insufficient to cover the transferAmount and transferFee.

func appendChangeTxOut(inputSatoshis int64, transferAmount int64, a *adapter, request types.BridgeTransferRequest, chainConfig *chaincfg.Params, tx *wire.MsgTx) error {
	const transferFee = 10_000 // TODO: Calculate
	changeSatoshis := inputSatoshis - transferAmount - transferAmount - transferFee

The potential for integer underflow can be demonstrated by setting inputSatoshis to a value less than double the transferAmount plus transferFee, which will result in changeSatoshis becoming negative, subsequently interpreted as a large positive value due to integer underflow.

Implement checks to ensure that calculations involving satoshis do not result in underflow or overflow conditions. Further, replace the hardcoded transferFee with a dynamically calculated fee based on current network conditions to ensure transaction reliability and cost-effectiveness.

Remediation Plan

SOLVED: The RuneMine team solved the issue by reimplementing the logic with appropriate checks.