BlockSec has unveiled the findings of a present audit for Neo X, the EVM-compatible sidechain fair at the moment launched by Neo. The audit identified three doable vulnerabilities, all of which occupy been rectified.
Methodology
The audit centered on the Neo X node implementation, in particular the changes made to Geth (hasten-ethereum), from which the Neo X node is forked. The dBFT consensus protocol used to be not incorporated within the audit scope.
BlockSec utilized a combination of automated code analyzers, fuzzers, and semantic prognosis to detect vulnerabilities. It additionally wicked-checked doable attack vectors with neutral audits to substantiate its findings earlier than offering fix suggestions.
Findings
The audit identified one excessive-possibility and two medium-possibility factors, all of which occupy been addressed by the Neo X crew.
The most valuable subject used to be the inability of ample validation for addresses making P2P community messages, integral to the dBFT protocol. This vulnerability has been mitigated by enforcing assessments inside the governance contract to make certain accurate permissions.
Both medium-possibility factors were learned inside the governance system. The principle pertained to a doable Denial of Carrier vector inside the governance contract. The contract allowed any user to pay a registration rate to alter into a validator candidate as much as a maximum ability.
Malicious actors might per chance presumably exploit this by utilizing the exitCandidate operate to assemble the overall registration rate refunded, minus transaction costs, effectively permitting them to bear the candidate slots without long-time length label. The Neo X crew resolved this by ensuring the overall rate isn’t any longer refundable, making such assaults prohibitively costly.
The 2nd medium-possibility subject alive to the absence of a timelock within the voting mechanism extinct for privileged operations inside the governance contract. This might per chance occasionally presumably per chance occupy enabled a antagonistic takeover of the currentConsensus validator list. The introduction of a timelock now offers an major rescue window to thwart doable assaults from malicious proposals.
The long-established announcement and audit document will be seen on the following link:
https://blocksec.com/audit-document/audit-document-neo-x
