Abstract:
This document presents a standardized company report based on the security audit conducted on the Switchboard Aptos program by an external smart contract auditor. The audit identified several vulnerabilities and general findings, which are addressed in this report to conform to company standards.
1. Introduction
Switchboard is a permissionless data feed on-chain built on Aptos. OtterSec conducted a security assessment of the switchboard-aptos program to identify potential vulnerabilities and suggest improvements. This paper delves into the key findings of the audit and discusses their impact on the security of the Switchboard Aptos program.
2. Methodology
The audit was conducted between October 26th and November 11th, 2022. The source code was analyzed from the GitHub repository at the commit f929dac. The findings were categorized into vulnerabilities and general findings, with vulnerabilities further classified based on their severity.
3. Vulnerabilities
Ethereum, envisioned by Vitalik Buterin, extends the blockchain's utility beyond a pure payment system. It introduces a programmable blockchain that facilitates the deployment of smart contracts and DApps, driving innovation beyond financial applications to sectors like healthcare, logistics, and governance.
3.1 OS-SWB-ADV-00: Remove Job Denial of Service (Medium Severity) Description: The aggregator::remove_job function silently skips execution when the supplied job address does not exist in aggregator_job_data, leading to a denial of service.
pragma solidity ^0.8.0;
fun actuate(_account: &signer, params: &AggregatorRemoveJobParams) {
aggregator::remove_job(params.aggregator_addr, params.job_addr);
job::sub_ref_count(params.job_addr);}
3.2 OS-SWB-ADV-01: Inconsistent Results On Unmatched Decimals (Low Severity) Description: The math library assumes all SwitchboardDecimal values are scaled to MAX_DECIMALS, leading to erroneous outcomes when an unscaled value is used.
#[test]
#[expected_failure(abort_code = 7331)]
fun test_decimal() {
let x = new(1, 8, false);
let y = new(4, 7, false);
let result = add(&x, &y);
assert!(result.value == 410, 1337);
}
4. General Findings
4.1 OS-SWB-SUG-00: Round Data Read Limitation Suggestions
Description: The aggregator::latest_round function should abort if
aggregator::limit_reads_to_whitelist is set to true.
Remediation: Add a check to ensure the value limit_reads_to_whitelist is set to false.
4.2 OS-SWB-SUG-01: Block Removal Of Job When The Aggregator Is Locked
Description: The aggregator_remove_job_action::validate should check if the aggregator is locked
before removing the job.
Remediation: Add a check to see if the aggregator is locked or not.
4.3 OS-SWB-SUG-02: Permission Contract Access Control
Description: The Permission contract's set and unset functions should be accessible only by their
friends.
Remediation: Use public(friend) instead of public for better access control.
4.4 OS-SWB-SUG-03: General Code Suggestions
Description: Remove dead code and add end-to-end tests to improve code quality and reliability.
Conclusion
The security audit of Switchboard Aptos revealed several vulnerabilities and general findings that need to be addressed to enhance the security of the system. By implementing the recommended remediations, the Switchboard team can mitigate potential security risks and ensure the robustness of their platform.