mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
125 lines
4.0 KiB
TeX
125 lines
4.0 KiB
TeX
\section{Security and Auditing}
|
|
|
|
|
|
\subsection{Security Model}
|
|
|
|
\subsubsection{Trust Assumptions}
|
|
|
|
\paragraph{Gnosis Safe} Lux DAO inherits Safe's security properties:
|
|
\begin{itemize}
|
|
\item Battle-tested multisig logic
|
|
\item Module system with guard protection
|
|
\item Extensive formal verification
|
|
\item Over \$100B secured since 2019
|
|
\end{itemize}
|
|
|
|
\paragraph{Azorius Module} Acts as trusted governor:
|
|
\begin{itemize}
|
|
\item Can execute arbitrary transactions on Safe
|
|
\item Controlled by Strategy contracts
|
|
\item Requires passed proposals for execution
|
|
\item Subject to timelock delays
|
|
\end{itemize}
|
|
|
|
\paragraph{Strategy Contracts} Trusted to enforce voting rules:
|
|
\begin{itemize}
|
|
\item Immutable voting parameters
|
|
\item Transparent vote tallying
|
|
\item No ability to execute transactions directly
|
|
\item Can be replaced via governance
|
|
\end{itemize}
|
|
|
|
\subsubsection{Attack Vectors and Mitigations}
|
|
|
|
\paragraph{Malicious Proposals}
|
|
|
|
\textit{Risk}: Proposal execution can call any contract with Safe permissions.
|
|
|
|
\textit{Mitigations}:
|
|
\begin{itemize}
|
|
\item Proposer restrictions (token threshold, role requirements)
|
|
\item Timelock period for community review
|
|
\item Freeze mechanism for emergency intervention
|
|
\item Transaction simulation before execution
|
|
\item Guard contracts for additional restrictions
|
|
\end{itemize}
|
|
|
|
\paragraph{Vote Manipulation}
|
|
|
|
\textit{Risk}: Attackers acquire governance tokens to influence outcomes.
|
|
|
|
\textit{Mitigations}:
|
|
\begin{itemize}
|
|
\item Snapshot-based voting (prevents flash loan attacks)
|
|
\item Multiple voting weight sources (harder to manipulate all)
|
|
\item Quorum requirements (raises attack cost)
|
|
\item Basis numerator thresholds (supermajority for sensitive actions)
|
|
\end{itemize}
|
|
|
|
\paragraph{Paymaster Exploitation}
|
|
|
|
\textit{Risk}: Malicious users spam votes to drain paymaster funds.
|
|
|
|
\textit{Mitigations}:
|
|
\begin{itemize}
|
|
\item Function-specific validators (only valid votes sponsored)
|
|
\item Per-strategy whitelisting (explicit authorization required)
|
|
\item Stake requirements on EntryPoint (bundler DoS protection)
|
|
\item Gas limit enforcement (prevents excessive consumption)
|
|
\item Real-time monitoring and circuit breakers
|
|
\end{itemize}
|
|
|
|
\paragraph{Upgrade Attacks}
|
|
|
|
\textit{Risk}: Malicious upgrade replaces contract logic.
|
|
|
|
\textit{Mitigations}:
|
|
\begin{itemize}
|
|
\item Ownership restricted to DAO Safe (requires governance)
|
|
\item UUPS pattern (upgrade logic transparent in implementation)
|
|
\item Upgrade proposals subject to timelock and voting
|
|
\item Critical contracts kept immutable where possible
|
|
\end{itemize}
|
|
|
|
\subsection{Audit History}
|
|
|
|
\paragraph{October 2022} Initial Azorius contracts audited by Trail of Bits:
|
|
\begin{itemize}
|
|
\item Core module functionality
|
|
\item Strategy patterns
|
|
\item Safe integration
|
|
\item No critical issues found
|
|
\end{itemize}
|
|
|
|
\paragraph{June 2024} Account abstraction integration audited by OpenZeppelin:
|
|
\begin{itemize}
|
|
\item Paymaster implementation
|
|
\item Validator contracts
|
|
\item EntryPoint integration
|
|
\item Two medium-severity findings (fixed):
|
|
\begin{itemize}
|
|
\item Validator reentrancy protection
|
|
\item Deposit balance checks
|
|
\end{itemize}
|
|
\end{itemize}
|
|
|
|
\paragraph{Ongoing} Bug bounty program via Immunefi:
|
|
\begin{itemize}
|
|
\item Up to \$100,000 for critical vulnerabilities
|
|
\item Covers all core governance contracts
|
|
\item Active monitoring and response team
|
|
\end{itemize}
|
|
|
|
\subsection{Formal Verification}
|
|
|
|
Key properties verified using symbolic execution (Certora):
|
|
|
|
\begin{enumerate}
|
|
\item \textbf{Proposal Integrity}: Proposal transactions cannot be modified after submission
|
|
\item \textbf{Vote Immutability}: Cast votes cannot be changed
|
|
\item \textbf{Execution Authorization}: Only passed proposals can execute
|
|
\item \textbf{Timelock Enforcement}: Proposals cannot execute during timelock
|
|
\item \textbf{Quorum Requirements}: Proposals without quorum cannot pass
|
|
\end{enumerate}
|
|
|