Obol - Charon DV Protocol
Audit · firm’s term: security assessment
Sigma Prime reviewed Obol (Obol - Charon DV Protocol) on 1 Jun 2023: 21 findings, 2 critical; 17 marked fixed, 4 acknowledged.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 5 |
| Medium | 0 | 1 | 2 |
| Low | 0 | 3 | 8 |
CriticalFrost DKG Does Not Validate Message Source Matches the SenderFixed
The report gives no description here.
CriticalKryptology Does Not Verify The Length of CommitmentsFixed
The report gives no description here.
HighInadequate Input Parameter Checks Resulting in Slice Bounds Out-of- Range ErrorFixed
The report gives no description here.
HighInsufficient Validation of Consensus Messages Leads to PanicsFixed
The report gives no description here.
HighLack of Size Checks When Slicing ArraysFixed
The report gives no description here.
Highnil Pointer References From Protobuf MessagesFixed
The report gives no description here.
HighQBFT Consensus Allows Replay of Justification MessagesFixed
The report gives no description here.
MediumFrost Broadcast Messages Do Not Use Reliable BroadcastFixed
The report gives no description here.
MediumPanics in coinbase/kryptology Frost ProtocolFixed
The report gives no description here.
LowCreateDKG Allows the Threshold to be Larger Than the Number of OperatorsFixed
The report gives no description here.
Show 7 more
LowCreateDKG Does Not Validate the Checksum of the Withdrawal AddressesFixed
The report gives no description here.
LowDuplicate Keys Allowed in ENRFixed
The report gives no description here.
LowInsufficient Validation of Consensus Message TypesFixed
The report gives no description here.
LowMiscellaneous General CommentsFixed
The report gives no description here.
LowRLP Length in Bits Rather Than BytesFixed
The report gives no description here.
Lowsigagg Does Not Ensure t Partials Are ReceivedFixed
The report gives no description here.
Lowsigagg Does Not Verify the Reconstructed SignatureFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Obol’s security record
Security firm
Sigma Prime36 projects reviewed · 78 reports · latest Aug 2026
See Sigma Prime’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us