Penetration Test Report (Atredis): Final Atredis Partners Agoric Inter Protocol Assessment v1.1

Agoric
Inter Protocol Assessment
Security Assessment Report
Project Team:
Prepared for Agoric Systems Technical Testing Brandon Perry and Loren
Operating Company Browman
September 21, 2022 (version Technical Editing Darren Kemp and Sara Bettes
1.1)
Project Management Sara Bettes
Atredis Partners www.atredis.com
Atredis Partners ⚫ Bene Diagnoscitur, Bene Curatur Confidential ⚫ For Intended Recipient Only
Atredis Partners – Agoric RUN Protocol Assessment
Table of Contents
Engagement Overview ............................................................................................... 3
Assessment Components and Objectives ................................................................. 3
Engagement Tasks ..................................................................................................... 4
Runtime Analysis ................................................................................................. 4
Source Code Analysis ........................................................................................... 4
Configuration and Architecture Review .................................................................... 4
Executive Summary ................................................................................................... 5
Key Conclusions .................................................................................................. 5
Platform Overview ............................................................................................... 5
Findings Summary ............................................................................................. 12
Findings and Recommendations .............................................................................. 13
Findings Summary ............................................................................................. 13
Findings Detail .................................................................................................. 13
Vault Factory: Lack of Input Validation When Adding New Vault Collateral Types .......... 14
Use Linter to Verify let and await Usage ................................................................ 16
Malformed Error Message when Pool Minimum Liquidity Insufficient............................ 17
Appendix I: Assessment Methodology .................................................................... 18
Appendix II: Engagement Team Biographies .......................................................... 21
Appendix III: About Atredis Partners ..................................................................... 26
Atredis Partners ⚫ Confidential Page 2
Atredis Partners – Agoric RUN Protocol Assessment
Engagement Overview
Assessment Components and Objectives
Agoric Systems Operating Company (“Agoric”) recently engaged Atredis Partners (“Atredis”)
to perform the Inter Protocol Assessment of the Agoric platform. Objectives included
validation that Agoric smart-contract platform was developed and deployed with security best
practices in mind.
Testing was performed from May 30 through June 23, by Brandon Perry and Loren Browman
of the Atredis Partners team, with Sara Bettes providing project management and delivery
oversight. For Atredis Partners’ assessment methodology, please see Appendix I of this
document, and for team biographies, please see Appendix II. Specific testing components and
testing tasks are included below.
COMPONENT ENGAGEMENT TASKS
Inter Protocol Assessment
Assessment Targets
• VaultFactory Contract
• Automated Market Maker (AMM) Contract
• Parity Stability Mechanism Contract
• Reserve + Rewards Mechanism
• BLD Boost Contract
Assessment Tasks
• Source-Assisted Penetration Testing of the Inter Protocol
• Analysis of all processing logic to ensure it meets
documented expectations
• Manual and automated runtime application testing
• Application spidering, fuzzing and fault injection
• PoC generation and validation of findings
• Development of adversarial unit tests where appropriate
Reporting and Analysis
Analysis and Deliverables
• Status Reporting and Realtime Communication
• Comprehensive Engagement Deliverable
• Engagement Outbrief and Remediation Review
The ultimate goal of the assessment was to provide a clear picture of risks, vulnerabilities,
and exposures as they relate to accepted security best practices, such as those created by
the National Institute of Standards and Technology (NIST), Open Web Application Security
Project (OWASP), or the Center for Internet Security (CIS). Augmenting these, Atredis
Partners also draws on its extensive experience in secure development and in testing high-
criticality applications and advanced exploitation.
Atredis Partners ⚫ Confidential Page 3
Atredis Partners – Agoric RUN Protocol Assessment
Engagement Tasks
Atredis Partners performed the following tasks, at a high level, for in-scope targets during the
engagement.
Runtime Analysis
For relevant software targets identified during the course of this engagement, Atredis
performed runtime analysis, using debugging and static analysis tools to analyze application
flow to aid in software security analysis. Where relevant, purpose-built tools such as custom
unit tests and customized clients were utilized to aid in vulnerability identification.
Source Code Analysis
Atredis Partners reviewed the in-scope application source code, with an eye for security-
relevant software defects. To aid in vulnerability discovery, application components were
mapped out and modeled until a thorough understanding of execution flow, code paths, and
application design and architecture were obtained. To aid in this process, the assessment
team engaged key stakeholders and members of the development team, where possible, to
provide structured walkthroughs and interviews, helping the team rapidly gain an
understanding of the application’s design and development lifecycle.
Configuration and Architecture Review
Atredis performed a high-level review of available documentation and configuration data with
an eye toward the overall functional design and soundness of the implementation. A key
aspect of this component was to identify gaps in the architecture and design regarding aspects
of design that reduce overall defensibility, aimed at pointing out fundamental issues in the
application architecture that should be addressed early in the development cycle as opposed
to later when the platform is closer to a full production state.
While specific vulnerabilities may be identified during the architecture and configuration
review, the intent was less on finding individual defects and more on how the design of a
given target affects its overall defensibility. Outcomes of the architecture review helped to
inform testing objectives throughout the rest of the engagement while also helping the client
define a long-term platform maturity and security design roadmap.
Atredis Partners ⚫ Confidential Page 4
Atredis Partners – Agoric RUN Protocol Assessment
Executive Summary
Testing targeted the Inter protocol which is comprised of 5 individual smart contracts
implementing various economic features. Atredis Partners assessed the Inter protocol as seen
in the public agoric-sdk repository at the commit beginning with fca3db8. The Agoric team
provided documentation for testing all contracts and was always available for support when
required.
Atredis Partners performed testing from the perspective of a regular system user with access
to all publicly exposed facets. Attacks requiring access to internal objects or creator facets
were also explored with the understanding that the associated risks are greatly mitigated by
the object-capability (OCAP) security architecture.
The focus of the testing was directed to ensuring all contract code paths safely validate user
input where possible and do not overly expose sensitive objects or internal state. Atredis also
prioritized test cases which seek to exploit the intended order of operations and reentrancy
hazards. Lower-level