Penetration Test Report (TrailOfBits): 0x protocol

0x Protocol
Security Assessment
October 4 th, 2 019
Prepared For:
Amir Bandeali | 0 x Protocol
amir@0x.org
Prepared By:
Gustavo Grieco | T rail of Bits
gustavo.grieco@trailofbits.com
Michael Colburn | T rail of Bits
michael.colburn@trailofbits.com
Robert Tonic | T rail of Bits
robert.tonic@trailofbits.com
Rajeev Gopalakrishna | T rail of Bits
rajeev@trailofbits.com
Changelog:
October 4, 2019: Initial draft delivery
October 11, 2019: Final report for publication
© 2019 Trail of Bits 0x Protocol Security Assessment | 1
Executive Summary
Engagement Goals & Scope
Coverage
Automated Testing and Verification
Exchange Contract
Exchange Libraries
Utils Contracts
Staking Contracts
MultiSig Wallet Contracts
Project Dashboard
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Fee refunds incentivize transaction centralization through market makers
2. Market makers have a reduced cost for performing front-running attacks
3. cancelOrdersUpTo can be used to permanently block future orders
4. setSignatureValidatorApproval race condition may be exploitable
5. WETH9 transferFrom often does not follow spec
6. Batch processing of transaction execution and order matching may lead to exchange
griefing
7. Zero fee orders are possible if a user performs transactions with a zero gas price
8. Lack of events for critical operations
9. Lack of validation in the makerAssetData and takerAssetData leads to unexpected
behavior
10. Transfers with zero fee amounts can log arbitrary data in their feeAssetData
11. MultiSigWallet does not check contract existence before call
12. Potential overflow in transactionId allowing arbitrary execution of transactions by a
malicious owner
13. Specification-Code mismatch for AssetProxyOwner timelock period
14. Potential overflow in MultiSigWalletWithTimelock when calculating whether the
timelock has passed
15. Rounding division errors can accumulate over partial fills
16. The Cobb–Douglas function is not properly documented and reverts with valid
parameters
17. Unclear documentation on how order filling can fail
© 2019 Trail of Bits 0x Protocol Security Assessment | 2
18. Potential single point of failure for "read-only-mode" and
"catastrophic-failure-mode"
19. ERC20 reverts during certain self-transfer
20. _assertStakingPoolExists never returns true
21. Calls to setParams may set invalid values and produce unexpected behavior in the
staking contracts
22. Malicious non-operator maker can decrease staking pool operator share
23. Non-operator makers can add or remove other makers
A. Vulnerability Classifications
B. Code Quality Recommendations
C. Tool Improvements
D. Formal verification using Manticore
E. Integrating fuzzing into the development and testing cycle
© 2019 Trail of Bits 0x Protocol Security Assessment | 3
Executive Summary
From August 5t h t hrough August 9t h, 2019, and September 9t h through October 4t h, 2019, 0x
hired Trail of Bits to review the security of their smart contracts focused on their upcoming
3.0 version. This new version includes staking features, aligning market participants with
the long-term mission, and objectives of 0x.
The project began with a week-long architecture review focused on the proposed 3.0
functionality and its potential impact on the protocol. The architecture review identified
high-risk areas of the 3.0 protocol and areas where the codebase could be modified to
better facilitate automated analysis. Several areas of the protocol—such as the extensive
use of assembly in the Exchange contract, arithmetic in the A ssetProxyOwner and
AssetProxy contracts, and state transitions throughout the entire system—were identified
for follow-up review due to either weak controls or insufficient time to fully investigate
them. 0x suggested that the future review should focus on automated testing of the 0x
protocol’s core properties.
This security assessment was conducted over the course of eight person-weeks, with four
engineers working from commit hash a bd479dc68fa75719647db[PII_REDACTED]25fd40d5 and
d21f978deff1be9321837c0d202ff188d94cb28c from the 0x repository.
During the first week of the security audit, we familiarized ourselves with the smart
contracts used by the 0x system and performed an initial review of the Exchange contract.
In the second week, we investigated the properties of orders and transactions and their
signature verification. In the third week, we focused on investigating complex interactions
and corner cases in the Exchange contract and also started to review the finalized version
of the staking contracts. For the final week of the assessment, Trail of Bits concluded the
automatic and manual reviews of the 0x contracts, which focused on the staking contracts.
Trail of Bits identified 23 issues, ranging from informational- to high-severity:
● A large number of the issues related to the order operations in the Exchange
contract and how users are supposed to interact with these.
● Using the gas price to compute protocol fees enabled zero fee orders and gave
makers a discounted price for front-running transactions.
● Issues arose from the MultiSig wallet implementation, including a lack of checks
before calls and potential integer overflow in the confirmation counter.
● Issues related to the role of makers in a staking pool and how malicious makers
could abuse their authority to add/remove other makers or decrease the operator’s
share of rewards.
● The remaining Issues were related to the ERC20 standard, missing events in critical
operations, and potential race conditions in signature validations.
© 2019 Trail of Bits 0x Protocol Security Assessment | 4
Throughout the audit, we developed automated analyses to help discover potential bugs in
the code. A high-level description of our approach is available below, and tool-specific
information is available in the appendices. We delivered all code used in the analyses along
with this report to enable continuous analysis as development proceeds.
● Appendix C documents changes in Echidna and Manticore to support the 0x
contracts and maximize the code they can review.
● Appendix D documents use of the Manticore symbolic executor to verify specific
code performing complex arithmetic computations.
● Appendix E documents our suggested use of Echidna to fuzz during CI testing.
The overall quality of the codebase is good. The architecture is modular and avoids
unnecessary complexity. Component interactions are well defined and properly
documented. The functions are small and easy to understand.
However, this codebase frequently contains corner cases that are not properly defined in
the specification and therefore could lead to security or correctness issues. These cases are
difficult to test with traditional unit tests or state-of-the-art fuzzing and symbolic execution
tools. For instance, the E xchange contract relies on orders that should be filled or canceled,
but attempts to fill certain orders that appear valid may fail due to the violation of internal
constraints that are unclear in the protocol specification and are not adequately exposed
to the end user. Additionally, the MultiSig wallet contracts had correctness and security
issues, and unclear specifications.
Trail of Bits recommends that 0x address the identified issues before deployment of the
version 3.0 codebase to production. The complexity of the new staking features is
significant, and they may contain additional issues. The staking contracts were not under
review until the final week of the assessment due to their active development during the
assessment and, therefore, we recommend further review of them.
© 2019 Trail of Bits 0x Protocol Security Assessment | 5
Engagement Goals & Scope
The goal of the engagement was to evaluate the security of the Exchange and the staking
contracts. Specifically, we sought to answer the following questions:
● Can participants abuse the Exchange trust model?
● Can participants delay, block, or alter orders or transactions from other users?
● Can