Improve the security of the Avalanche network by auditing, porting and testing its fundamental tools on OpenBSD/adJ
{"type": "project", "title": "Improve the security of the Avalanche network by auditing, porting and testing its fundamental tools on OpenBSD/adJ", "logoImg": "bafkreicjekx2up5igmrlgmryzrtyxbnwuyqtq2u72sutgbemny5x63w56a", "website": "https://www.pasosdejesus.org/avalanche-adJ/index.html", "bannerImg": "bafkreiadnl3ryv2huugxfthwf4ja635bkwlnfaqqylo5n7mu47oemw52nm", "createdAt": 1713288934714, "userGithub": "vtamara", "credentials": {"github": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..9I4bNcPncXgkXMFiSj2o5YjrkEfKdbuZMb5s5HXlxElhZfxc1PB-GCbBY_YDf0aM2OPJ4h4YtcabZbFVhsxLBQ", "type": "Ed25519Signature2018", "created": "2024-04-16T17:08:15.511Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-16T17:08:15.511Z", "expirationDate": "2024-07-15T17:08:15.511Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:jMgNV9IRChHicb6fkbTaU3tMlmNatPeEFuRR60w3cWk=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextGithubOrg#pasosdeJesus#701221"}}, "twitter": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..RBTTq4ii9CrrtR3huWUhgTX5uUIJZPQ6zVHjnvRcizyuuMhJWL-10L-7MiiO4JhESwuo_RAKDTYlu2SvPqHODQ", "type": "Ed25519Signature2018", "created": "2024-04-16T17:07:25.230Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-16T17:07:25.230Z", "expirationDate": "2024-07-15T17:07:25.230Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:8GTsHv2TY2pgasZsJn3xarA9BCVV4B8YDP58pmmJiaw=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextTwitter#VladimirTamara"}}}, "description": "We propose to improve the security of the Avalanche network as a whole by:\n\n1. Auditing the source code of the Avalanche tools and some of the libraries on which they depend. To audit we will follow the [methodology of OpenBSD](https://www.openbsd.org/security.html)\n\n2. Porting the libraries and the fundamental avalanche tools to OpenBSD/adJ (at least `avalanchego`, `subnet-evm`, `coreth`, `avalanche-network-runner`, `precompile-evm` and `avalanche-cli`)\n\n3. On OpenBSD/adJ run the tests of the Avalanche tools and use them with different use cases (including a validator and developing dApps) and with loads as close as production as possible to discover runtime failures that could point to security flaws.\n\n4. Report the problems found and recommend ways to improve and/or propose Pull Requests to fix them.\n\nUp to now we have concentrated more in the porting effort but it already gave fruit in improving security:\n* We contributed 3 pull requests with small improvements in portability. They were already merged in the main avalanche tools\n* We contributed one pull request that adds support for OpenBSD to `avalanchego`.  This one is waiting approval and hopefully merging.\n* We helped to improve the security of one library that is central for the Avalance protocol.    The Avalanche protocol depends on the BLS12-381 signature, in the source code it is implemented by the library  [supranational/blst](https://github.com/supranational/blst). Using our methodology we reported a crash of this library in OpenBSD/adJ  due to a security feature of that OS (see [issue 206](https://github.com/supranational/blst/issues/206)). With our feedback the author of `blst` solved the problem and improved the security of the library with the  commits [dae1f](https://github.com/supranational/blst/commit/dae1f9416f157112be1dc46209a32ed5414fd525) and [6cca1](https://github.com/supranational/blst/commit/6cca12ac0c10ca8752d1788ee44891261c0f272a) --a constant table required for the cryptographic BLS12-381 signature library now is in a section for constants (`.rodata`) not allowing an attacker to modify it after the program starts.\n\nWith the funding of this project we will go through a full audit of the sources, completing the porting effort and more integral testing to keep contributing pull requests and suggestions to improve the security of Avalanche tools and the libraries that they depend on.\n\nPlease see details of the results as we progress in the project  [web page](https://www.pasosdejesus.org/avalanche-adJ/index.html)", "logoImgData": {}, "bannerImgData": {}, "projectGithub": "pasosdeJesus", "projectTwitter": "VladimirTamara"}