Zcash Ecosystem Security Lead

Community Grants Applications
89

May highlights:

  • Audited most of @hanh’s Ledger code, I just have some of the heavy cryptographic stuff (like the elliptic curve implementation) left to audit.
  • Audited Nighthawk’s lightwalletd deployment scripts.
  • Figured out how bridgetree works and convinced myself wallets can update their witnesses efficiently in private (yay!).
  • I also spent a lot of time on Dev Fund related discussions (which I’m not billing for!) :slight_smile:

June is going to be a bunch of audit wrap-up stuff, hopefully getting as many things as possible to a stage where I can talk about them in my Zcon talk (which was accepted!).

13 Likes
90

I made this chart for my Zcon4 talk but I figured I’d post it here to give the community a summary of the bugs I’ve found through the funding that ZCG has given me. Here’s a breakdown of bugs the I’ve discovered over the past ~year:

Bugs Discovered, by Type
Bugs Discovered, by Type993×614 26.5 KB

The bug categories should be somewhat self-explanatory. The bug severities are somewhat subjective, and I define them as follows:

A “Critical” issue is a vulnerability that can definitely be exploited to impact many users with devastating consequences. “High” means a vulnerability that is likely to have a severe impact on many users. “Medium” means a vulnerability of moderate impact or one that may only be exploitable in special circumstances. “Low” means a vulnerability whose exploitation would have very little impact on any user or is is unlikely to ever be exploited in practice.

“Critical” and “High”-severity issues must be fixed as soon as possible to protect users. “Medium”-severity issues are sometimes safe to defer, and “Low”-severity issues are almost always safe to defer.

In total, I found 83 bugs, 41 of which are rated as medium or above, and 23 of which are rated high or above.

15 Likes
91

Update for the months of June and July:

  • Zcon4! My talk about security engineering can be seen here.
  • Wrapped up my audit of Hanh’s hardware wallet (good coverage of everything except the elliptic-curve implementations).
  • Looked at audit reports to give a quick security sanity check to ZecHub on using DAODAO.
  • Started on auditing Zingo.
  • Put up a warning about the milk sad vulnerability
13 Likes
92

Here’s the current status of audit reports on the road to being published:

image
image1047×260 17.3 KB

12 Likes
93

August update: I’ve mainly been focused on wrapping up existing audits (see the table above), and also working on an audit of Zingo. I’ve quickly reviewed Zingo’s mobile app codebase (which is mostly GUI code) and I’m currently working through the zingolib repo where all of the actual scanning and wallet logic lives.

11 Likes
94

The report from my mini audit of Free2Z (back in February) is posted here: Free2Z Security Audit Results | ZecSec: Zcash Ecosystem Security

5 Likes
95

The results of auditing @hanh’s Ledger app are now out! Results of Auditing Hanh's Shielded Zcash Ledger App | ZecSec: Zcash Ecosystem Security

9 Likes
96

zecwallet-lite-cli audit report: Security Audit of zecwallet-lite-cli | ZecSec: Zcash Ecosystem Security

2 Likes
98

Imitation game?

2 Likes
99

Starting in October, I will be stepping away from my role as the Zcash community’s resident security auditor, more details on my blog:

13 Likes
100

just watched your zc0n4 talk,
huge thanks for your care and contribution!!

3 Likes
101

In September/October I wrapped up the grant with:

  • A quick audit of Zingo
  • A quick audit of Nighthawk
  • Helping respond to centralized mining pools
  • Other wrap-up tasks like preparing a handoff package for the next person/org to take on this role, reviewed the Nym grant application, updated my ecosystem overview page, etc.
14 Likes
102

Thank you for your service :saluting_face:

4 Likes
103

We will miss you :cry: thanks for all the work you’ve done for the Zcash Ecosystem.

4 Likes
104

I just posted the results of auditing ZGo (from April of last year). There were some interesting issues there, thanks to the ZGo folks for an awesome security response!

7 Likes