Nodle

During the security assessment of the oracle binary, it was observed that sensitive information, specifically private keys, are required to be passed as command-line arguments when executing the binary. This practice exposes private keys in the process's command line, which can be accessed by any user on the same system with permissions to view the process list, as well as potentially being exposed in logging or in other monitoring tools accessible on the Google Cloud platform. This represents a significant security risk as command-line arguments are not a secure medium for transmitting sensitive information due to their high visibility.

The off-chain component of the bridge runs periodically and processes some number of blocks. The off-chain components are sending transactions to the target network as they are processing the blocks. It was observed that there is no explicit check assuring that the block being processed is finalized. As a consequence, in a scenario when an unfinalized block is reverted, however it was already processed by the off-chain component, a double-spending opportunity arises. User whose interaction with the evm_bridge contract was reverted can do it again in new block which would result in a second valid bridging operation from the off-chain component's perspective.

Floating pragmas is a feature of Solidity that allows developers to specify a range of compiler versions that can be used to compile the smart contract code. For security purposes specifically, the usage of floating pragmas is discouraged and not recommended. Contracts should be compiled and deployed with a strict pragma, the one which was thoroughly tested the most by developers. Locking the pragma helps ensure that contracts do not accidentally get deployed using too old or too recent compiler versions that might introduce security issues that impact the contract negatively.It should be noted however that, pragma statements can be allowed to float when a contract is intended for consumption by other developers, as in the case with contracts in a library or EthPM package.The smart contracts of Nodle protocol make use of floating pragmas. These are not intended for use as libraries for other developers and, as such, should be locked of their pragma.

The evm_bridge contract parses the Ethereum-compatible address to make sure that it is a legitimate one and bridging process can be performed successfully. However, it was observed that the check does not take into account the chainId values, i.e. it does not verify them in accordance with EIP1191 standard. It does not impact the security of the contract, however it is considered a best practice, because it will limit user error.