iExec PoCo

Off-Chain (Private)

Audited on 2020/02/29

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with iExec to review their PoCo (Proof of Contribution) protocol. The review was conducted over the course of two weeks, from March 30, 2020 to April 10, 2020 by Gonçalo Sá and Shayan Eskandari. A total of 15 person-days were spent. During the first week, we focused our efforts on understanding the intention of the design (which is mostly provided through communication with the client and the resources provided in the README of the main repository under review, poco-dev), and defining the key risk factors and potential vulnerabilities requiring further investigation.

Project

iExec

Ethereum

Issues (7)

	Low	Medium	High	Critical	Total
Not fixed	3	4	-	-	7
Fixed	-	-	-	-	0
Total	3	4	0	0	7

Contracts (48)

#	File Name
31	poco-dev/contracts/registries/datasets/DatasetRegistry.sol
32	poco-dev/contracts/modules/delegates/IexecAccessorsABILegacyDelegate.sol
33	poco-dev/contracts/modules/interfaces/IexecAccessorsABILegacy.sol
34	poco-dev/contracts/modules/delegates/IexecERC20Delegate.sol
35	poco-dev/contracts/registries/apps/App.sol
36	poco-dev/contracts/modules/delegates/IexecERC20Common.sol
37	poco-dev/contracts/IexecInterfaceNative.sol
38	poco-dev/contracts/registries/workerpools/WorkerpoolRegistry.sol
39	poco-dev/contracts/modules/interfaces/IexecOrderManagement.sol
40	poco-dev/contracts/modules/delegates/IexecOrderManagementDelegate.sol

#	File Name
31	poco-dev/contracts/registries/datasets/DatasetRegistry.sol
32	poco-dev/contracts/modules/delegates/IexecAccessorsABILegacyDelegate.sol
33	poco-dev/contracts/modules/interfaces/IexecAccessorsABILegacy.sol
34	poco-dev/contracts/modules/delegates/IexecERC20Delegate.sol
35	poco-dev/contracts/registries/apps/App.sol
36	poco-dev/contracts/modules/delegates/IexecERC20Common.sol
37	poco-dev/contracts/IexecInterfaceNative.sol
38	poco-dev/contracts/registries/workerpools/WorkerpoolRegistry.sol
39	poco-dev/contracts/modules/interfaces/IexecOrderManagement.sol
40	poco-dev/contracts/modules/delegates/IexecOrderManagementDelegate.sol

iExec PoCo

Summary

Issues (7)

Domain separator in iExecMaintenanceDelegate has a wrong version fieldnot_fixed/medium

importScore() in IexecMaintenanceDelegate can be used to wrongfully reset worker scoresnot_fixed/medium

Outdated documentationnot_fixed/medium

System deployer is fully trusted in this version of the PoCo systemnot_fixed/medium

Limit the length of task.contributors to prevent reaching gasBlockLimitnot_fixed/low

Contracts (48)