Secure3 揭露 Neo X Bridge 審計報告

Neo 發布了 Secure3 進行的審計競賽的結果，Secure3 是一個與安全專家合作識別和減輕 Web3 協議威脅的平台。

Web3 protocol security platform Secure3 has completed an audit of the Neo Native Bridge, which was developed by Bane Labs to facilitate asset transfers between Neo N3 and Neo X. The audit aimed to ensure the integrity and security of the bridge, which is crucial for safeguarding user funds and maintaining the integrity of the Neo ecosystem.

Web3協議安全平台Secure3已完成對Bane Labs開發的Neo Native Bridge的審計，該審計旨在促進Neo N3和Neo X之間的資產轉移。維護網路安全至關重要用戶資金並維護 Neo 生態系統的完整性。

The Neo Native Bridge comprises two primary components: a bridge smart contract deployed on Neo X and a relayer code that facilitates communication between Neo N3 and Neo X. The audit focused on both these aspects to identify and mitigate any potential vulnerabilities or risks.

Neo Native Bridge 包含兩個主要組件：部署在Neo X 上的橋智能合約和促進Neo N3 和Neo X 之間通信的中繼器代碼。或風險。

? Bridge contract audit

? 橋樑合約審核

The audit of the Neo X Bridge Contract identified several issues, including a medium-severity concern related to token registration and deregistration. This issue could potentially allow replay attacks on the bridge, posing a significant risk to the security of asset transfers.

Neo X Bridge 合約的審計發現了幾個問題，包括與代幣註冊和註銷相關的中等嚴重程度的問題。此問題可能會導致對橋的重播攻擊，從而對資產轉移的安全性構成重大風險。

The audit team highlighted this issue and worked closely with the Neo team to resolve it promptly. The system was modified to disallow the deregistration of token bridges, effectively mitigating the identified risk and ensuring the integrity of the Neo Native Bridge.

審計團隊強調了這個問題，並與 Neo 團隊密切合作，迅速解決。該系統經過修改，不允許註銷令牌橋，有效降低已識別的風險並確保 Neo Native Bridge 的完整性。

Furthermore, the audit uncovered several low-severity concerns, which were either acknowledged for future resolution or fixed by adopting more secure alternatives. These included:

此外，審計發現了一些低嚴重性的問題，這些問題要么被承認以供未來解決，要么通過採用更安全的替代方案來解決。其中包括：

The use of safeTransferFrom instead of transferFrom, which could lead to unexpected behavior with certain tokens due to non-standard ERC20 implementations. This was addressed by using OpenZeppelin’s SafeERC20 library.

使用 safeTransferFrom 而不是 TransferFrom，這可能會因為非標準 ERC20 實作而導致某些代幣出現意外行為。已透過使用 OpenZeppelin 的 SafeERC20 庫解決了這個問題。

The use of the ecrecover function, which limited validators to externally owned accounts and made the system vulnerable to signature malleability, potentially enabling forgery or replay attacks. These issues were either acknowledged for future resolution or fixed by switching to more secure alternatives like OpenZeppelin’s ECDSA.recover function.

使用 ecrecover 函數將驗證器限制為外部擁有的帳戶，並使系統容易受到簽章延展性的影響，可能導致偽造或重播攻擊。這些問題要么得到確認以供將來解決，要么通過切換到更安全的替代方案（例如 OpenZeppelin 的 ECDSA.recover 功能）來修復。

Minor informational issues, such as code style inconsistencies and unused errors, were also identified and addressed where necessary.

必要時也識別並解決了一些次要的資訊問題，例如程式碼風格不一致和未使用的錯誤。

? Bridge relayer audit

? 橋接中繼審核

The audit of the Neo X Bridge Relayer also revealed several low-severity issues, which were promptly addressed or acknowledged for future improvements. These included:

Neo X Bridge Relayer 的審查也發現了幾個低嚴重性問題，這些問題得到了及時解決或確認，以便將來進行改進。其中包括：

The relayer’s program continued to run indefinitely in the event of a non-connection-related error, potentially leading to resource exhaustion. This was resolved by ensuring the program exits appropriately in such scenarios.

如果發生與連線無關的錯誤，中繼器的程式將繼續無限期地運行，這可能會導致資源耗盡。透過確保程式在這種情況下正確退出來解決這個問題。

The potential for a denial of service attack due to the lack of a timeout in the signature processing function, which was fixed by implementing a timeout mechanism.

由於簽章處理功能中缺少逾時，可能會導致拒絕服務攻擊，該問題已透過實施逾時機制解決。

The system did not verify the uniqueness of signatures, which could allow possible bypasses. This issue was acknowledged and will be addressed in future updates.

系統沒有驗證簽名的唯一性，這可能允許繞過。此問題已得到確認，並將在未來的更新中解決。

The hardcoded threshold for the number of signatures required for relayer operations, which limited the flexibility of the system. This was acknowledged, and a more dynamic approach will be implemented in future releases.

中繼器操作所需的簽名數量的硬編碼閾值限制了系統的靈活性。這已得到承認，並將在未來的版本中實施更動態的方法。

Other informational issues, such as improper handling of decrypted accounts, insecure password storage, and the risk of race conditions due to the use of goroutines in loops, were also noted. While most of these issues were promptly addressed, some were acknowledged and earmarked for future improvements.

還指出了其他資訊問題，例如解密帳戶的不當處理、不安全的密碼儲存以及由於在循環中使用 goroutine 而導致的競爭條件風險。雖然大多數問題都得到了及時解決，但也有一些問題得到了承認並指定用於未來的改進。

The full reports can be found in the announcement linked below: https://medium.com/neo-smart-economy/disclosing-the-neo-x-audit-report-by-secure3-1b7eae9dc47b

完整報告可在以下連結的公告中找到：https://medium.com/neo-smart-economy/disending-the-neo-x-audit-report-by-secure3-1b7eae9dc47b