Secure3 披露 Neo X Bridge 审计报告

Neo 发布了 Secure3 进行的审计竞赛的结果，Secure3 是一个与安全专家合作识别和减轻 Web3 协议威胁的平台。

Web3 protocol security platform Secure3 has completed an audit of the Neo Native Bridge, which was developed by Bane Labs to facilitate asset transfers between Neo N3 and Neo X. The audit aimed to ensure the integrity and security of the bridge, which is crucial for safeguarding user funds and maintaining the integrity of the Neo ecosystem.

Web3协议安全平台Secure3已完成对Bane Labs开发的Neo Native Bridge的审计，该审计旨在促进Neo N3和Neo X之间的资产转移。此次审计旨在确保桥的完整性和安全性，这对于维护网络安全至关重要用户资金并维护 Neo 生态系统的完整性。

The Neo Native Bridge comprises two primary components: a bridge smart contract deployed on Neo X and a relayer code that facilitates communication between Neo N3 and Neo X. The audit focused on both these aspects to identify and mitigate any potential vulnerabilities or risks.

Neo Native Bridge 包含两个主要组件：部署在 Neo X 上的桥智能合约和促进 Neo N3 和 Neo X 之间通信的中继器代码。审计重点关注这两个方面，以识别和减轻任何潜在的漏洞或风险。

? Bridge contract audit

? 桥梁合同审核

The audit of the Neo X Bridge Contract identified several issues, including a medium-severity concern related to token registration and deregistration. This issue could potentially allow replay attacks on the bridge, posing a significant risk to the security of asset transfers.

Neo X Bridge 合约的审计发现了几个问题，包括与代币注册和注销相关的中等严重程度的问题。此问题可能会导致对桥的重放攻击，从而对资产转移的安全构成重大风险。

The audit team highlighted this issue and worked closely with the Neo team to resolve it promptly. The system was modified to disallow the deregistration of token bridges, effectively mitigating the identified risk and ensuring the integrity of the Neo Native Bridge.

审计团队强调了这一问题，并与 Neo 团队密切合作，迅速解决。该系统经过修改，不允许注销令牌桥，有效降低已识别的风险并确保 Neo Native Bridge 的完整性。

Furthermore, the audit uncovered several low-severity concerns, which were either acknowledged for future resolution or fixed by adopting more secure alternatives. These included:

此外，审计发现了一些低严重性的问题，这些问题要么被承认以供未来解决，要么通过采用更安全的替代方案来解决。其中包括：

The use of safeTransferFrom instead of transferFrom, which could lead to unexpected behavior with certain tokens due to non-standard ERC20 implementations. This was addressed by using OpenZeppelin’s SafeERC20 library.

使用 safeTransferFrom 而不是 TransferFrom，这可能会由于非标准 ERC20 实现而导致某些代币出现意外行为。已通过使用 OpenZeppelin 的 SafeERC20 库解决了这个问题。

The use of the ecrecover function, which limited validators to externally owned accounts and made the system vulnerable to signature malleability, potentially enabling forgery or replay attacks. These issues were either acknowledged for future resolution or fixed by switching to more secure alternatives like OpenZeppelin’s ECDSA.recover function.

使用 ecrecover 函数将验证器限制为外部拥有的帐户，并使系统容易受到签名延展性的影响，从而可能导致伪造或重放攻击。这些问题要么得到确认以供将来解决，要么通过切换到更安全的替代方案（例如 OpenZeppelin 的 ECDSA.recover 功能）来修复。

Minor informational issues, such as code style inconsistencies and unused errors, were also identified and addressed where necessary.

必要时还识别并解决了一些次要的信息问题，例如代码风格不一致和未使用的错误。

? Bridge relayer audit

? 桥接中继审核

The audit of the Neo X Bridge Relayer also revealed several low-severity issues, which were promptly addressed or acknowledged for future improvements. These included:

Neo X Bridge Relayer 的审核还发现了几个低严重性问题，这些问题得到了及时解决或确认，以便将来进行改进。其中包括：

The relayer’s program continued to run indefinitely in the event of a non-connection-related error, potentially leading to resource exhaustion. This was resolved by ensuring the program exits appropriately in such scenarios.

如果发生与连接无关的错误，中继器的程序将继续无限期地运行，这可能会导致资源耗尽。通过确保程序在这种情况下正确退出来解决这个问题。

The potential for a denial of service attack due to the lack of a timeout in the signature processing function, which was fixed by implementing a timeout mechanism.

由于签名处理功能中缺少超时，可能会导致拒绝服务攻击，该问题已通过实施超时机制得到解决。

The system did not verify the uniqueness of signatures, which could allow possible bypasses. This issue was acknowledged and will be addressed in future updates.

系统没有验证签名的唯一性，这可能允许绕过。此问题已得到确认，并将在未来的更新中得到解决。

The hardcoded threshold for the number of signatures required for relayer operations, which limited the flexibility of the system. This was acknowledged, and a more dynamic approach will be implemented in future releases.

中继器操作所需的签名数量的硬编码阈值限制了系统的灵活性。这已得到承认，并且将在未来的版本中实施更加动态的方法。

Other informational issues, such as improper handling of decrypted accounts, insecure password storage, and the risk of race conditions due to the use of goroutines in loops, were also noted. While most of these issues were promptly addressed, some were acknowledged and earmarked for future improvements.

还指出了其他信息问题，例如解密帐户的不当处理、不安全的密码存储以及由于在循环中使用 goroutine 导致的竞争条件风险。虽然大多数问题都得到了及时解决，但也有一些问题得到了承认并指定用于未来的改进。

The full reports can be found in the announcement linked below: https://medium.com/neo-smart-economy/disclosing-the-neo-x-audit-report-by-secure3-1b7eae9dc47b

完整报告可在以下链接的公告中找到：https://medium.com/neo-smart-economy/disending-the-neo-x-audit-report-by-secure3-1b7eae9dc47b