Connext NXTP — Noncustodial Xchain Transfer Protoc
Consensys reviewed Connext Network (Connext NXTP — Noncustodial Xchain Transfer Protoc) on 1 Jul 2021: 29 findings, 1 critical; 8 marked fixed, 21 open.
Report hosted on diligence.security.
Trustblock does not review code.
Findings29
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 5 | 0 | 1 |
| Medium | 7 | 0 | 2 |
| Low | 9 | 0 | 4 |
HighRouter - handleMetaTxRequest - gas griefing / race conditions / missing validations / free meta transactionsOpen
The report gives no description here.
HighRouter - handler reports an error condition but continues execution instead of aborting itOpen
The report gives no description here.
HighRouter - spawns unauthenticated admin API endpoint listening on all interfacesOpen
The report gives no description here.
HighRouter - subgraphLoop may process transactions the router was not configured for (code fragility)Open
The report gives no description here.
HighTransactionManager - Receiver-side check also on sending sideOpen
The report gives no description here.
MediumRouter - Cancel is not implementedOpen
The report gives no description here.
MediumRouter - handleNewAuction - fragile codeOpen
The report gives no description here.
MediumRouter - handleSenderPrepare - missing validation, unchecked bidExpiry, unchecked expiry, unchecked chainids/swaps, race conidtionsOpen
The report gives no description here.
MediumRouter - Provide and enforce safe defaults (config)Open
The report gives no description here.
MediumTODO comments should be resolvedOpen
The report gives no description here.
Show 10 more
MediumTransactionManager - Relayer may use user’s cancel after expiry signature to steal user’s funds by colluding with a routerOpen
The report gives no description here.
MediumTransactionManager.prepare - Possible griefing/denial of service by front-runningOpen
The report gives no description here.
LowFulfillInterpreter - ReentrancyGuard can be removed PendingOpen
The report gives no description here.
LowFulfillInterpreter - Wrong order of actions in fallback handlingOpen
The report gives no description here.
LowRouter - Always perform strict validation of data received from third-parties or untrusted sourcesOpen
The report gives no description here.
LowRouter - config file is missing the swapPools attribute and credentials are leaked to console in case of invalid configOpen
The report gives no description here.
LowRouter - handling of native assetID (0x000..00, e.g. ETH) not implementedOpen
The report gives no description here.
LowRouter - Logging ConsistencyOpen
The report gives no description here.
LowSdk.finishTransfer - missing validationOpen
The report gives no description here.
LowTransactionManager - Adherence to EIP-712Open
The report gives no description here.
Show 1 more
LowTransactionManager - Hard-coded chain ID might lead to problems after a chain splitOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
- packages/contracts/interfaces/IFulfillInterpreter.sol
- packages/contracts/ProposedOwnable.sol
- packages/contracts/libraries/WadRayMath.sol
- packages/contracts/interfaces/IERC20Minimal.sol
- packages/contracts/TransactionManager.sol
- packages/contracts/libraries/Asset.sol
- packages/contracts/interpreters/FulfillInterpreter.sol
- packages/contracts/interfaces/ITransactionManager.sol
Part of Connext Network’s security record
Connext NetworkSecurity firm
Consensys41 projects reviewed · 59 reports · latest Oct 2024
See Consensys’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us