Datachain - LCPs
Quantstamp reviewed Datachain (Datachain - LCPs) on 9 Dec 2024: 7 findings, 0 critical; all marked fixed.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings7
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 7 |
LowConsider Using `rand::rndg::OsRng` for More RobustnessFixed
The function `get_quote()` in `ias_utils.rs` uses `rand::thread_rng()` which provides a pseudorandom value in each thread independently which might not be as robust or secure as desired.
LowDependency RisksFixed
The [Cargo audit](https://github.com/RustSec/rustsec/tree/main/cargo-audit) report has identified potential dependency risks. Here is a summary of the risks: **Key Vulnerabilities:** 1. **curve25519-dalek (v3.2.0)** - **Issue**: Timing variability in `Scalar29::sub` and `Scalar52::sub`. - **Solution**: Upgrade to version >= 4.1.3. - **Link**: [RUSTSEC-2024-0344](https://rustsec.org/advisories/RUSTSEC-2024-0344) 2. **ed25519-dalek (v1.0.1)** - **Issue**: Double Public Key Signing Function Oracle Attack. - **Solution**: Upgrade to version >= 2. - **Link**: [RUSTSEC-2022-0093](https://rustsec.org/advisories/RUSTSEC-2022-0093) 3. **h2 (v0.3.19)** - **Issue**: CONTINUATION Flood vulnerability causing service degradation. - **Solution**: Upgrade to ^0.3.26 or >= 0.4.4. - **Link**: [RUSTSEC-2024-0332](https://rustsec.org/advisories/RUSTSEC-2024-0332) 4. **libgit2-sys (v0.15.2)** - **Issue**: Memory corruption, denial of service, and arbitrary code execution. - **Solution**: Upgrade to version >= 0.16.2. - **Link**: [RUSTSEC-2024-0013](https://rustsec.org/advisories/RUSTSEC-2024-0013) 5. **rsa (v0.9.2)** - **Issue**: Timing side-channel vulnerability (Marvin Attack). - **Solution**: No available fix. - **Link**: [RUSTSEC-2023-0071](https://rustsec.org/advisories/RUSTSEC-2023-0071) 6. **rustls (v0.19.1 and v0.20.6)** - **Issue**: Infinite loop vulnerability in network input handling. - **Solution**: Upgrade to specific patched versions. - **Link**: [RUSTSEC-2024-0336](https://rustsec.org/advisories/RUSTSEC-2024-0336) 7. **shlex (v1.1.0)** - **Issue**: Quote API issues. - **Solution**: Upgrade to version >= 1.3.0. - **Link**: [RUSTSEC-2024-0006](https://rustsec.org/advisories/RUSTSEC-2024-0006) 8. **tungstenite (v0.17.3)** - **Issue**: Denial of service vulnerability. - **Solution**: Upgrade to version >= 0.20.1. - **Link**: [RUSTSEC-2023-0065](https://rustsec.org/advisories/RUSTSEC-2023-0065) 9. **webpki (v0.21.4)** - **Issue**: CPU exhaustion in certificate path building. - **Solution**: Upgrade to version >= 0.22.2. - **Link**: [RUSTSEC-2023-0052](https://rustsec.org/advisories/RUSTSEC-2023-0052) **Other Warnings:** 1. Unmaintained Crates: Several crates, including `atty`, `buf_redux`, `mach`, and `multipart`, are unmaintained and may need replacement. 2. Yanked Crates: Some crates, such as `futures-util` and `hermit-abi`, are marked as yanked. <br> **Additionally**, we have manually identified some outdated dependencies that can be upgraded: 1. The codebase is using the `tiny_keccak` library version 1.5, while the latest version is 2.0.2 ([crates.io](https://crates.io/crates/tiny-keccak)). 2. It is also using `sha2` version 0.10.6, while the latest is 0.10.8. 3. The API version used for the attestation mechanism is v4, while the latest is v5. We recommend addressing these vulnerabilities and updating the outdated dependencies to enhance the security and reliability of the project.
LowEnclave Key Remains in Memory After UseFixed
The enclave key currently remains in memory after it is unsealed and used. Since it represents the critical source of trust in the system, limiting its exposure to hardware level attacks is recommended.
LowEnclave Leaking Panic ContentsFixed
The panic handler added to this forked crate makes use of `ocall` to pass panic information outside of the enclave, simply forwarding the info associated with the panic.
LowNot Returning Error or Reverting when Size OverflowsFixed
The `calc_raw_sealed_data_size()` function returns `max` when there is an unexpected size. This is a copy of the implementation from the [sgx_tseal/src/internal.rs](https://github.com/apache/incubator-teaclave-sgx-sdk/blob/1b1d03376056321441ef99716aa0888bd5ef19f7/sgx_tseal/src/internal.rs#L97-L109). However, in the Rust SGX SDK, it will error out (see: [code](https://github.com/apache/incubator-teaclave-sgx-sdk/blob/1b1d03376056321441ef99716aa0888bd5ef19f7/sgx_tseal/src/internal.rs#L301)) at the place calling when receiving the `max` output. We suggest that the same should be applied here.
LowPanic Due to Out-of-Boundary AccessFixed
The `LCPUtils.readBytesUntil()` function calls the `BytesUtils.find()` function. The `BytesUtils.find()` function has the `len` input, which represents the number of bytes to search (see: [code comment](https://github.com/ensdomains/ens-contracts/blob/160919f5612e52347f016a537c6278ecc0f2325a/contracts/dnssec-oracle/BytesUtils.sol#L383)). The current implementation passes `src.length` as the `len` input, which will trigger a panic when the needle is not found, as it will attempt to search outside of `src.length`. There is no real impact feature-wise, as `readBytesUntil()` intends to revert with `LCPUtilsReadBytesUntilNotFound()` when the needle is not found. However, it might make it hard to identify the reason for a failed transaction.
LowUsage of Unrecommended `parse_overflowing_slice()`Fixed
The `verify_signature()` function uses `Signature::parse_overflowing_slice()`, which is not recommended according to its [code comment](https://github.com/paritytech/libsecp256k1/blob/48dabd8821852c5fe00b846f6c37e1f6b05c3d8c/src/lib.rs#L558-L560). The code comment recommends using `parse_standard_slice()` instead.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (100)
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/004-verify_channel_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/008-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/README.md at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/Makefile at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/014-verify_channel_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/002-init_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/proto/ibc/lightclients/lcp/v1/LCP.proto at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/.solhint.json at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/ReportTest.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/007-verify_packet_receipt_absence_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/003-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/010-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/ContractUpgrade.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPClientBase.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/LCPClientTest.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPClient.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/004-verify_channel_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/004-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/CertificateTest.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/package.json at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/LCPUtilsTest.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/005-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/010-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/reports/valid/002-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/006-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/005-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/package-lock.json at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/TestHelper.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/006-verify_packet_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/012-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/.gitignore at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/002-init_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/Asn1Decode.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/solpb.sh at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/003-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/005-init_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/003-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/003-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPUtils.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/proto/ibc/lightclients/lcp/v1/LCP.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/009-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/002-init_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/reports/invalid/001-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/003-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/007-verify_packet_receipt_absence_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/017-verify_packet_receipt_absence_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/.gitmodules at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/foundry.toml at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/006-verify_packet_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/reports/valid/001-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/001-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/007-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/scripts/gencert.sh at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/AVRValidator.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/009-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/certs/intel_signing.der at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/reports/valid/operator_0xc1eae5EF781f4EE5867eC6725630E7dC17fa3436 at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/016-verify_packet_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/013-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/LCPClientOperator.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/005-init_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/007-verify_packet_receipt_absence_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/ILCPClientErrors.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/certs/simulation_rootca.der at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPCommitment.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/.github/workflows/test.yml at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/016-verify_packet_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/006-verify_packet_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/011-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/LCPCommitmentTest.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/008-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/007-verify_packet_receipt_absence_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/004-verify_channel_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPClientOwnableUpgradeable.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPProtoMarshaler.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/014-verify_channel_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/001-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/002-init_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/002-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/005-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/013-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/015-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/contracts/LCPOperator.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/006-verify_packet_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/certs/Intel_SGX_Attestation_RootCA.der at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/012-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/007-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/01/004-verify_channel_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/LCPClientBenchmark.t.sol at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/.gitignore at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/011-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/certs/simulation_signing.der at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/001-avr at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/.solhintignore at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/02/005-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/006-update_client_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/017-verify_packet_receipt_absence_result at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/LICENSE at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/test/data/client/03/015-update_client_input at commit 54d2bac
- https://github.com/datachainlab/lcp-solidity/slither.config.json at commit 54d2bac
Part of Datachain’s security record
DatachainSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us