nimbus-eth2/docs/nbc_audit_2020

NBC Audit 2020

This folder contains the description, tasks and scope of Nimbus audit pre-mainnet launch.

RFP:

• https://our.status.im/nimbus-eth2-0-security-audit-request-for-proposal

The audit was done in 3 phases, related branches are:

• https://github.com/status-im/nimbus-eth2/tree/nbc-audit-2020-0
• https://github.com/status-im/nimbus-eth2/tree/nbc-audit-2020-1
• https://github.com/status-im/nimbus-eth2/tree/nbc-audit-2020-2

The audit involved 3 vendors:

• Consensys Diligence: https://consensys.net/diligence/
• NCC: https://www.nccgroup.com/
• Trail of Bits: https://www.trailofbits.com/

Outline

Module	Repository	Audit round	Category
Wire encryption	nim-crypto, nim-libp2p, nim-bearssl	Round 1	Network Core Audit
Ethereum 2 Request/Response protocol	nimbus-eth2, nim-faststreams, nim-serialization	Round 1	Network Core Audit
Discover Protocol (discv5)	nim-eth	Round 1	Network Core Audit
SSZ - (De)serialization & tree hashing	nimbus-eth2	Round 2	Network Core Audit
Block/attestation signing	nimbus-eth2, nim-blscurve	Round 2	Validator Core Audit
Peer pool management	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Block Synchronization	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Fork choice logic	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Reward processing	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Eth1 data processing	nimbus-eth2, nim-web3	Round 2	ETH2 Specification Core Audit
Epoch finalisation and justification	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Signature verification	nimbus-eth2, nim-blscurve	Round 2	ETH2 Specification Core Audit
State transition logic	nimbus-eth2	Round 2	ETH2 Specification Core Audit
Publish/Subscribe protocol (gossipsub)	nim-libp2p	Round 4	Network Core Audit
Command Line Interface (CLI)	nimbus-eth2, nim-confutils	Round 3	Validator Core Audit
RPC API	nimbus-eth2, nim-json-rpc	Round 3	Validator Core Audit
Accounts management & key storage	nimbus-eth2	Round 3	Validator Core Audit
Slash-prevention mechanisms	nimbus-eth2	Round 3	Validator Core Audit
Attestation processing and production	nimbus-eth2	Round 3	ETH2 Specification Core Audit
Block processing and production	nimbus-eth2	Round 3	ETH2 Specification Core Audit