Polkadot Security Analysis and Audit Contest Polkadot Parity Subxt

Overview

Polkadot is a multi-chain interoperability platform designed to achieve interoperability between different blockchains. It allows various blockchain networks to communicate with each other and share information while remaining efficient and secure.

Substrate is a blockchain framework for building custom blockchains. It is one of the core components of the Polkadot ecosystem because Polkadot itself is built using Substrate. Substrate provides a rich set of tools and components that enable developers to easily create blockchains for their specific needs. These blockchains can run independently, or they can choose to join the Polkadot network and become its “parachain”.

The subxt library enables you to submit transactions to a Substrate node through remote procedure calls. Before you use the subxt library, you can use the standalone subxt command-line interface to download the metadata for the Substrate node you want to use as the target for submitting transactions. The subxt-cli tool enables you to perform two key tasks that are critical to using the subxt library:

You can use the subxt-cli tool to download the metadata from any target Substrate node.
You can use the subxt-cli tool to generate the runtime API code from the metadata from any target Substrate node.

Audit Q&A

Public code repo
- https://github.com/Secure3Audit/code_Parity-subxt
How many files are in scope?
- 69
Total SLoC for these contracts?
- 10973
How many external imports are there?
- 48
Is this an upgrade to an existing system?
- False
Is there a need to understand a separate part of the codebase / get context in
order to audit this part of the protocol?
- True
Please describe the required context
- Knowledge of Polkadot and substrate.
Is this either a fork of or an alternate implementation of another project?
- False

Any other technical documents

Files in scope

The primary objective of this audit is to conduct a thorough examination of the subxt/subxt/src directory within the paritytech/subxt project. The focus will be on assessing code quality, security, performance, and adherence to best practices in Rust programming.

Details please refer to https://github.com/Secure3Audit/code_Parity-subxt

Module	Lines	Description
backend	3796	This module exposes a backend trait for Subxt which allows us to get and set the necessary information (probably from a JSON-RPC API, but that’s up to the implementation).
config	824	This module provides a Config type, which is used to define various types that are important in order to speak to a particular chain. SubstrateConfig provides a default set of these types suitable for the default Substrate node implementation, and PolkadotConfig for a Polkadot node.
custom_values	208	Types associated with accessing custom types
error	396	Types representing the errors that can be returned.
metadata	99	Types representing the metadata obtained from a node.
storage	524	Types associated with accessing and working with storage items.
utils	928	Miscellaneous utility helpers.
constants	129	Types associated with accessing constants.
events	774	This module exposes the types and such necessary for working with events. The two main entry points into events are crate::OnlineClient::events() and calls like crate::tx::TxProgress::wait_for_finalized_success().
runtime_api	239	Types associated with executing runtime API calls.
tx	1058	Create and submit extrinsics
blocks	981	This module exposes the necessary functionality for working with events.
client	859	This module provides two clients that can be used to work with transactions, storage and events. The OfflineClient works entirely offline and can be passed to any function that doesn’t require network access. The OnlineClient requires network access.
dynamic	55	This module provides the entry points to create dynamic transactions, storage and constant lookups.

Known issues

What has been reported in

https://github.com/paritytech/subxt/issues?q=is%3Aissue+is%3Aclosed+label%3Abug

Exclusions — What’s NOT in Scope

Static websites, until you can find a way to compromise the data on the website for all of the visitors.
Bugs which have already been submitted by another user or are already known to the Parity team or have already been publicly disclosed.
Bugs in third-party tools and services we’re using (but we would be glad to connect you with the security team of the corresponding project).
Parity Technologies’ development team, Parity Technology employees and any other person employed or providing services in any way to the company, directly or indirectly, are not eligible for rewards. Social engineering attacks are also here.
Anything that contravenes the spirit or letter of this Program.

Overview

You can use the subxt-cli tool to download the metadata from any target Substrate node.
You can use the subxt-cli tool to generate the runtime API code from the metadata from any target Substrate node.

Audit Q&A

Public code repo
- https://github.com/Secure3Audit/code_Parity-subxt
How many files are in scope?
- 69
Total SLoC for these contracts?
- 10973
How many external imports are there?
- 48
Is this an upgrade to an existing system?
- False
Is there a need to understand a separate part of the codebase / get context in
order to audit this part of the protocol?
- True
Please describe the required context
- Knowledge of Polkadot and substrate.
Is this either a fork of or an alternate implementation of another project?
- False

Any other technical documents

Files in scope

Details please refer to https://github.com/Secure3Audit/code_Parity-subxt

Module	Lines	Description
backend	3796	This module exposes a backend trait for Subxt which allows us to get and set the necessary information (probably from a JSON-RPC API, but that’s up to the implementation).
config	824	This module provides a Config type, which is used to define various types that are important in order to speak to a particular chain. SubstrateConfig provides a default set of these types suitable for the default Substrate node implementation, and PolkadotConfig for a Polkadot node.
custom_values	208	Types associated with accessing custom types
error	396	Types representing the errors that can be returned.
metadata	99	Types representing the metadata obtained from a node.
storage	524	Types associated with accessing and working with storage items.
utils	928	Miscellaneous utility helpers.
constants	129	Types associated with accessing constants.
events	774	This module exposes the types and such necessary for working with events. The two main entry points into events are crate::OnlineClient::events() and calls like crate::tx::TxProgress::wait_for_finalized_success().
runtime_api	239	Types associated with executing runtime API calls.
tx	1058	Create and submit extrinsics
blocks	981	This module exposes the necessary functionality for working with events.
client	859	This module provides two clients that can be used to work with transactions, storage and events. The OfflineClient works entirely offline and can be passed to any function that doesn’t require network access. The OnlineClient requires network access.
dynamic	55	This module provides the entry points to create dynamic transactions, storage and constant lookups.

Known issues

What has been reported in

https://github.com/paritytech/subxt/issues?q=is%3Aissue+is%3Aclosed+label%3Abug

Exclusions — What’s NOT in Scope

Static websites, until you can find a way to compromise the data on the website for all of the visitors.
Bugs which have already been submitted by another user or are already known to the Parity team or have already been publicly disclosed.
Bugs in third-party tools and services we’re using (but we would be glad to connect you with the security team of the corresponding project).
Parity Technologies’ development team, Parity Technology employees and any other person employed or providing services in any way to the company, directly or indirectly, are not eligible for rewards. Social engineering attacks are also here.
Anything that contravenes the spirit or letter of this Program.

#	Competitor	Reward (USD)	Total Findings	Solo	High	Med	Solo High	Solo Med	Low	Info
1	biakia	29,333	6	3	0	3	0	3	3	0
2	BradMoonUESTC	10,333	2	1	0	1	0	1	1	0
2	Saaj	10,333	2	1	0	1	0	1	1	0
4	slowfrog	0	0	0	0	0	0	0	0	0
4	jack	0	0	0	0	0	0	0	0	0
4	toffee	0	0	0	0	0	0	0	0	0
4	Hupixiong3	0	0	0	0	0	0	0	0	0
4	alansh	0	0	0	0	0	0	0	0	0

Polkadot Parity Subxt

Polkadot

Overview

Audit Q&A

Links

Any other technical documents

Files in scope

Known issues

Overview

Audit Q&A

Links

Any other technical documents

Files in scope

Known issues

Polkadot Parity Subxt

Polkadot

Winners