Disclosing the Neo X Bridge Audit Report by Secure3

Neo has released the results of an audit contest conducted by Secure3, a platform that collaborates with security experts to identify and mitigate threats to Web3 protocols.

Web3 protocol security platform Secure3 has completed an audit of the Neo Native Bridge, which was developed by Bane Labs to facilitate asset transfers between Neo N3 and Neo X. The audit aimed to ensure the integrity and security of the bridge, which is crucial for safeguarding user funds and maintaining the integrity of the Neo ecosystem.

The Neo Native Bridge comprises two primary components: a bridge smart contract deployed on Neo X and a relayer code that facilitates communication between Neo N3 and Neo X. The audit focused on both these aspects to identify and mitigate any potential vulnerabilities or risks.

? Bridge contract audit

The audit of the Neo X Bridge Contract identified several issues, including a medium-severity concern related to token registration and deregistration. This issue could potentially allow replay attacks on the bridge, posing a significant risk to the security of asset transfers.

The audit team highlighted this issue and worked closely with the Neo team to resolve it promptly. The system was modified to disallow the deregistration of token bridges, effectively mitigating the identified risk and ensuring the integrity of the Neo Native Bridge.

Furthermore, the audit uncovered several low-severity concerns, which were either acknowledged for future resolution or fixed by adopting more secure alternatives. These included:

The use of safeTransferFrom instead of transferFrom, which could lead to unexpected behavior with certain tokens due to non-standard ERC20 implementations. This was addressed by using OpenZeppelin’s SafeERC20 library.

The use of the ecrecover function, which limited validators to externally owned accounts and made the system vulnerable to signature malleability, potentially enabling forgery or replay attacks. These issues were either acknowledged for future resolution or fixed by switching to more secure alternatives like OpenZeppelin’s ECDSA.recover function.

Minor informational issues, such as code style inconsistencies and unused errors, were also identified and addressed where necessary.

? Bridge relayer audit

The audit of the Neo X Bridge Relayer also revealed several low-severity issues, which were promptly addressed or acknowledged for future improvements. These included:

The relayer’s program continued to run indefinitely in the event of a non-connection-related error, potentially leading to resource exhaustion. This was resolved by ensuring the program exits appropriately in such scenarios.

The potential for a denial of service attack due to the lack of a timeout in the signature processing function, which was fixed by implementing a timeout mechanism.

The system did not verify the uniqueness of signatures, which could allow possible bypasses. This issue was acknowledged and will be addressed in future updates.

The hardcoded threshold for the number of signatures required for relayer operations, which limited the flexibility of the system. This was acknowledged, and a more dynamic approach will be implemented in future releases.

Other informational issues, such as improper handling of decrypted accounts, insecure password storage, and the risk of race conditions due to the use of goroutines in loops, were also noted. While most of these issues were promptly addressed, some were acknowledged and earmarked for future improvements.

The full reports can be found in the announcement linked below: https://medium.com/neo-smart-economy/disclosing-the-neo-x-audit-report-by-secure3-1b7eae9dc47b