Penetration Test Report (NCCGroup): NCC Group Zcash ZCHX006 Report 2020 09 03 v2.0

NU4 Cryptographic Specification and
Implementation Review
Zcash
September 3, 2020 – Version 2.0
Preparedfor
BenjaminWinston
Preparedby
PaulBottinelli
Marie-SarahLacharité
ThomasPornin
©2020–NCCGroup
PreparedbyNCCGroupSecurityServices,Inc. forZcash. Portionsofthisdocumentandthetemplates
usedinitsproductionarethepropertyofNCCGroupandcannotbecopied(infullorinpart)without
NCCGroup’spermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,NCCGroupthepublisher,and
theauthor(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseof
the information contained herein. Use of NCC Group’s services does not guarantee the security of a
system,orthatcomputerintrusionswillnotoccur.
Executive Summary
Synopsis project,whichincludedtheimplementationoftheZIPs
InJune2020, theElectricCoinCompanyengagedNCC described above, in the form of the following Pull
Group to conduct a security review of the six Zcash Requests(PRs):
Improvement Proposals (ZIPs) that constitute the core
• ZIP207andZIP214: https://github.com/zcash/zcash
of the upcoming “Canopy” upgrade (also called “NU4”)
/pull/4560
totheZcashnetwork. Thisupgradecoincideswiththe
• ZIP251: https://github.com/zcash/zcash/pull/4487
first Zcash halving and will initiate a new development
• ZIP211: https://github.com/zcash/zcash/pull/4489
fund for the next four years. The audit was meant to
• ZIP 212: https://github.com/zcash/zcash/pull/4578
identify vulnerabilities that may result from application
andhttps://github.com/zcash/librustzcash/pull/258
of the ZIPs, including consensus breaches induced
• ZIP215: https://github.com/zcash/zcash/pull/4581
by diverging implementations arising from incomplete
• Changes to the ed25519-zebra library to implement
or unclear specifications. NCC Group assigned three
the validation rules of ZIP 215: https://github.com/Z
consultantstothespecificationauditforatotalofeight
cashFoundation/ed25519-zebra/pull/24
person-days.
Finally,twoversionsoftheZcashProtocolSpecification,
In a continuation of this effort, NCC Group was tasked
datingfromAugust3rd,2020(version2020.1.122)and
withreviewingtheimplementationofthesixaforemen-
August11th,2020(version2020.1.133),whichincluded
tioned ZIPs in August 2020. The audit was meant to
modifications introduced by the above ZIPs, were also
assess the consistency of the implementation with the
usedasareferencesforphase2.
proposedchangesintheprotocolspecification,identify
vulnerabilities that may have been introduced, as well Appendix A on page 30 summarizes all the relevant
as review general programming practices. NCC Group referencespertainingtothereview.
assigned two consultants to the implementation audit
Limitations
foratotalofeightperson-days.
One of the goals of a security review of specification
Scope
documentsistoidentifypointsthatarenotcoveredin
TheauditscopewasthesixfollowingZIPs: sufficientclarity,andmaythusresultinincompatibilities
when implemented by separate teams. The notion of
• ZIP 214 – Consensus rules for a Zcash Development
clarity is subjective and relies on assumptions about
Fund: https://zips.z.cash/zip-0214
the level of understanding and competence of future
• ZIP207–FundingStreams: https://zips.z.cash/zip-02
implementers. Moreover, in the first phase of the
07
assessment, which took place in the middle of June
• ZIP 251 – Deployment of the Canopy Network Up-
2020,theZIPsthemselveswerenotthefinalformofthe
grade: https://zips.z.cash/zip-0251
proposedchanges.
• ZIP 211 – Disabling Addition of New Value to the
SproutValuePool: https://zips.z.cash/zip-0211 Thus,phase2oftheaudit,whichwasprimarilyfocused
• ZIP212–AllowRecipienttoDeriveSaplingEphemeral on the implementation of the proposed changes, also
Secret from Note Plaintext: https://zips.z.cash/zip-02 included some limited review of the updated ZIPs
12 and protocol specification. These modifications were
• ZIP 215 – Explicitly Defining and Modifying Ed25519 introducedbetweenthetwophasesoftheassessment,
ValidationRules: https://zips.z.cash/zip-0215 partly as part of the standard Zcash development
process, butalsotoaddresssomeofthepointsraised
The ZIPs’ published states as of June 5th, 2020 were
duringphase1.
used for the first part of the audit. Their modification
historyisavailableintheGitHubrepositoryathttps://gi NCCGrouptriedtoerronthesideofcaution,andmany
thub.com/zcash/zips. oftheremarksinthisreportmaycorrespondinglylook
likeminorquibbles.
In the second part of the audit, the implementation
reviewwascenteredaroundversion3.1.01oftheZcash
1https://github.com/zcash/zcash/tree/v3.1.0
2https://github.com/zcash/zips/blob/fb64b2e4303b332ef8960fc6bbf34b0598596c5d/protocol/protocol.pdf
3https://github.com/zcash/zips/blob/6e5278ed95e334dc861838da26857d1c0dcf638f/protocol/protocol.pdf
2 | ZcashNU4CryptographicSpecificationandImplementationReview NCCGroup
KeyFindings
No potentially serious vulnerability was found in the
reviewedZIPsthemselves.
While reviewing ZIP 215, NCC Group noticed that the
current implementation of Ed25519 signature verifica-
tion, used in JoinSplit descriptions, did not faithfully
adhere to the current protocol in some specific edge
cases. Though none of these cases will ever be hit
by non-malicious implementations, they could still be
used to induce a breach of consensus between the
currentZcashimplementationandtheoreticalalternate
implementations that would closely adhere to the
publishedprotocol. ApplicationofZIP215willindirectly
mitigatemostofthisissue,butanedgecasewillremain
possible, unless explicitly addressed. This issue is
detailedinfindingNCC-ZCHX006-001onpage23.
Thisedgecasewassubsequentlyaddressedinthelatest
versionoftheprotocolspecification.
StrategicRecommendations
In order to maintain strict consistency in wording and
typography across future ZIPs, an explicit and detailed
styleguideshouldbewrittenandmaintained.
The code base could also benefit from more specific
anddetailedcomments,particularlysincetheconstant
updatestothecodeintheformofZIPsaddnon-trivial
layersofcomplexity.
3 | ZcashNU4CryptographicSpecificationandImplementationReview NCCGroup
Dashboard
TargetMetadata EngagementData
Name CanopyNetworkUpgrade Type SpecificationandImplementation
Review
Type ProtocolSpecificationand Method ArchitecturalandCodeReview
Implementation
Platforms Zcash Dates 2020-06-01to2020-08-14
Consultants 3
LevelofEffort 16person-days
Targets
ZIP214 https://zips.z.cash/zip-0214
ZIP207 https://zips.z.cash/zip-0207
ZIP251 https://zips.z.cash/zip-0251
ZIP211 https://zips.z.cash/zip-0211
ZIP212 https://zips.z.cash/zip-0212
ZIP215 https://zips.z.cash/zip-0215
ImplementationofZIP207andZIP214 https://github.com/zcash/zcash/pull/4560
ImplementationofZIP251 https://github.com/zcash/zcash/pull/4487
ImplementationofZIP211 https://github.com/zcash/zcash/pull/4489
ImplementationofZIP212 https://github.com/zcash/zcash/pull/4578
ChangestolibrustzcashforZIP212 https://github.com/zcash/librustzcash/pull/258
ImplementationofZIP215 https://github.com/zcash/zcash/pull/4581
Changestoed25519-zebraforZIP215 https://github.com/ZcashFoundation/ed25519-zebra/pull/24
FindingBreakdown
Criticalissues 0
Highissues 0
Mediumissues 0
Lowissues 2
Informationalissues 0
Totalissues 2
CategoryBreakdown
Cryptography 1
DataValidation 1
ComponentBreakdown
Ed25519 1
Wallet 1
Key
Critical High Medium Low Informational
4 | ZcashNU4CryptographicSpecificationandImplementationReview NCCGroup
Audit Notes – Phase 1
AuditScope
TheauditcoversthesixZIPsdescribedintheScopesectionoftheExecutiveSummaryonpage2. Additionally,Ap-
pendixAonpage30summarizesalltherelevantreferencespertainingtothereview.
All ZIPs were reviewed in their published state, as of June 5th, 2020. In the following sections, NCC Group first
summarizes each ZIP and offers remarks, most of which are editorial in nature. A later section lists more editorial
remarksthatapplytoseveralZIPs,inparticular,wordingconsistencyissues.
Ingeneral,nosecurityvulnerabilitywasfoundintheauditedZIPs. Apotentialconsensusbreachissuewasdetected
inthecu