Prepared by:
HALBORN
Last Updated 10/24/2024
Date of Engagement by: August 5th, 2024 - August 26th, 2024
100% of all REPORTED Findings have been addressed
All findings
4
Critical
0
High
0
Medium
2
Low
1
Informational
1
Artela engaged Halborn to conduct a security assessment on their halo module, beginning on Halborn to conduct a security assessment on the appchain modules, beginning on 08/05/2024 and ending on 08/26/2024. The security assessment was scoped to the sections of code that pertain to the modules. Commit hashes and further details can be found in the Scope section of this report.
Halborn was provided 3 weeks for the engagement and assigned 1 full-time security engineer to review the security of the smart contracts in scope. The engineer is a blockchain and smart contract security experts with advanced penetration testing and smart contract hacking skills, and deep knowledge of multiple blockchain protocols.
The purpose of the assessment is to:
- Ensure that the Artela Chain Modules operate as intended.
- Identify potential security issues with the Artela Chain Modules in the Artela Chain.
In summary, Halborn identified some security concerns that were mostly addressed by the Artela team.
Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of the custom modules. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of structures and can quickly identify items that do not follow security best practices. The following phases and associated tools were used throughout the term of the assessment:
- Research into architecture and purpose.
- Static Analysis of security for scoped repository, and imported functions. (e.g., staticcheck, gosec, unconvert, codeql, ineffassign and semgrep)
- Manual Assessment for discovering security vulnerabilities in the codebase.
- Ensuring the correctness of the codebase.
- Dynamic Analysis of files and modules related to the modules.
| EXPLOITABILIY METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Attack Origin (AO) | Arbitrary (AO:A) Specific (AO:S) | 1 0.2 |
| Attack Cost (AC) | Low (AC:L) Medium (AC:M) High (AC:H) | 1 0.67 0.33 |
| Attack Complexity (AX) | Low (AX:L) Medium (AX:M) High (AX:H) | 1 0.67 0.33 |
| IMPACT METRIC () | METRIC VALUE | NUMERICAL VALUE |
|---|---|---|
| Confidentiality (C) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Integrity (I) | None (I:N) Low (I:L) Medium (I:M) High (I:H) Critical (I:C) | 0 0.25 0.5 0.75 1 |
| Availability (A) | None (A:N) Low (A:L) Medium (A:M) High (A:H) Critical (A:C) | 0 0.25 0.5 0.75 1 |
| Deposit (D) | None (D:N) Low (D:L) Medium (D:M) High (D:H) Critical (D:C) | 0 0.25 0.5 0.75 1 |
| Yield (Y) | None (Y:N) Low (Y:L) Medium (Y:M) High (Y:H) Critical (Y:C) | 0 0.25 0.5 0.75 1 |
| SEVERITY COEFFICIENT () | COEFFICIENT VALUE | NUMERICAL VALUE |
|---|---|---|
| Reversibility () | None (R:N) Partial (R:P) Full (R:F) | 1 0.5 0.25 |
| Scope () | Changed (S:C) Unchanged (S:U) | 1.25 1 |
| Severity | Score Value Range |
|---|---|
| Critical | 9 - 10 |
| High | 7 - 8.9 |
| Medium | 4.5 - 6.9 |
| Low | 2 - 4.4 |
| Informational | 0 - 1.9 |
Critical
0
High
0
Medium
2
Low
1
Informational
1
| Security analysis | Risk level | Remediation Date |
|---|---|---|
| Lack Of Eth Rpc Support On Artela Chain | Medium | Solved - 08/29/2024 |
| Incorrect Gas Used Calculation In Transaction Receipt | Medium | Solved - 08/29/2024 |
| Docker image running as root | Low | Risk Accepted |
| The HTTP/2 protocol in Golang 1.21.5 is susceptible to DoS attacks | Informational | Acknowledged |
// Medium
The Artela chain currently does not support standard Ethereum (ETH) RPC calls. This limitation significantly impacts the chain's compatibility with existing Ethereum tools, libraries, and dApps.
1. Reduced Developer Adoption: Ethereum developers face barriers in porting their existing applications to Artela, potentially slowing ecosystem growth.
2. Limited Tool Compatibility: Popular Ethereum development tools, wallets, and explorers may not function correctly with Artela.
- web3_clientVersion
- debug_storageRangeAt
- eth_maxPriorityFeePerGas
- eth_getRawTransactionByHash
- eth_fillTransaction
- eth_pendingTransactions
- eth_coinbase
- eth_resend
- debug_traceTransaction
- debug_traceCall
- trace_callTo address this issue and improve Artela's compatibility with the Ethereum ecosystem, we recommend the following actions:
1. Implement ETH RPC Compatibility Layer:
- Develop a compatibility layer that translates standard Ethereum RPC calls to their Artela equivalents.
- Prioritize implementing the most commonly used RPC methods first, such as eth_getBalance, eth_sendTransaction, and eth_call.
SOLVED: The Artela team solved the issue by adding RPC calls.
// Medium
In the GetTransactionReceipt function, the gasUsed field of the transaction receipt is incorrectly set to the gas limit of the transaction (`txData.GetGas()`) instead of the actual gas used by the transaction (`res.GasUsed`).
Current implementation:
"gasUsed": hexutil.Uint64(txData.GetGas())Replace txData.GetGas() with res.GasUsed in the gasUsed field assignment.
SOLVED: The Artela team solved the issue by implementing the suggested recommendation.
// Low
Docker containers generally run with root privileges by default. This allows for unrestricted container management, meaning a user could install system packages, edit configuration files, bind privileged ports, etc. During static analysis, it was observed that the docker image is maintained through the root user.
FROM golang:1.21.5-bullseye as build-env
# Install minimum necessary dependencies
ENV PACKAGES curl make git libc-dev bash gcc
RUN apt-get update && apt-get upgrade -y && \
apt-get install -y $PACKAGES
# Set working directory for the source copy
WORKDIR /go/src/github.com/artela-network
# Add source files
COPY ./artela ./artela
# Reset the working directory for the build
WORKDIR /go/src/github.com/artela-network/artela
# disable optimisation and strip for remote debugging
ENV COSMOS_BUILD_OPTIONS "nostrip,nooptimization"
# build artelad
RUN make build
# Final image
FROM golang:1.21.5-bullseye as final
WORKDIR /
RUN apt-get update && \
go install github.com/go-delve/delve/cmd/dlv@latest
# Add GO Bin to PATH
ENV PATH "/go/bin:${PATH}"
# Copy over binaries from the build-env
COPY --from=build-env /go/src/github.com/artela-network/artela/build/artelad /
COPY --from=build-env /go/src/github.com/artela-network/artela/scripts/start-artela.sh /
EXPOSE 26656 26657 1317 9090 8545 8546 19211
# Run artelad by default, omit entrypoint to ease using container with artelad
ENTRYPOINT ["/bin/bash", "-c"]To mitigate this issue, it is recommended to follow the principle of least privilege and run the container as a non-root user. This can be achieved by creating a dedicated user within the Dockerfile and running the application as that user.
RISK ACCEPTED: The Artela team accepted the risk of the issue.
// Informational
A vulnerability was discovered with the implementation of the HTTP/2 protocol in Golang prior to 1.21.9 and 1.22.2 versions. The current version used in app chain is 1.21.
An attacker can cause the HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. This causes excessive CPU consumption of the receiver device since there is no sufficient limitation on the amount of frames. Thus, It could be exploited to cause DoS.
Please note that, many HTTP/2 implementations (including Golang) did not properly limit the amount of CONTINUATION frames within a single stream.
References:
The issue is fixed in both Golang 1.21.9 and 1.22.2. However, If you are intending to use 1.21.X, It is recommended upgrading to 1.21.11 (the latest of 1.21.X) since it has some other security/bug fixes in net/http package.
ACKNOWLEDGED: The Artela team acknowledged the issue.
Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.
// Download the full report
* Use Google Chrome for best results
** Check "Background Graphics" in the print settings if needed