Immunefi Audit CompetitionsStacks I Attackathon
Reports by Severity
Critical
High
- 38516 - [BC - High] Signer can censor transactions and halt the network by providing an invalid nonce o
- 37479 - [BC - High] A single signer can lock users' funds by not notifying other signers of the execute
- 38398 - [BC - High] Malicious Signers can initiate repeated contract calls to cause the multi-sign wall
- 38111 - [BC - High] Attackers can send a very large event in a Stacks block so that the Signer can neve
- 38477 - [BC - High] A single signer can abort every attempted signing round by providing an invalid pac
- 38053 - [BC - High] A single signer can continuously prevent signatures from being finalized, halting n
- 38740 - [BC - High] The missing check in Deposits::DepositScriptInputs::parse() permits losing funds by
- 38392 - [BC - High] Signer can steal STX tokens in multi-sign wallet by setting a high stacks tx fee
- 38582 - [BC - High] The BitcoinCoreClient::get_tx_info does not support coinbase transactions, which
- 37814 - [BC - High] Signers can crash other signers by sending an invalid DkgPrivateShares due to mis
- 37811 - [BC - High] Missing length check when parsing SignatureShareRequest in the signers allows the
- 37718 - [BC - High] Key rotations bricks the system due to incorrect aggregate_key being used to spen
Medium
- 37545 - [BC - Medium] Deposits with a lock_time of 16 cannot be processed
- 38003 - [BC - Medium] A malicious coordinator calling Emily::update_deposits can make the entire Sign
- 38270 - [BC - Medium] A signer can send a large number of junk WstsNetMessage::NonceRequest through P
- 37470 - [BC - Medium] SBTC Signers do not page through pending deposit requests making it trivially eas
- 38551 - [BC - Medium] A signer can request stacks tx nonces in batches in advance and then DoS other si
- 37384 - [BC - Medium] Attacker can front-run call to emily api with incorrect data, preventing legit us
- 38133 - [BC - Medium] A rogue Signer can censor any deposit request from being processed and fullfilled
- 37777 - [BC - Medium] Emily.create_deposit can overwrite any deposit to the Pending state
Low
- 37500 - [BC - Low] Blocklist can be circumvented due to incorrect blocking logic in request_decider::c
- 38460 - [BC - Low] The coordinator can set a higher BTC tx fee than the current network to make users t
- 38028 - [BC - Low] There is a Partial Network Degradation Due to DynamoDB GSI Throttling Under High Tra
- 38605 - [BC - Low] Lack of fee_rate/last_fees validation in handle_bitcoin_pre_sign_request ebables rog
Insight
- 37530 - [BC - Insight] Deposits can be completely DoSed due to incorrect transaction construction
- 38160 - [BC - Insight] Governance calling sbtc-registry.update-protocol-contract may cause Stacks' ev
- 38690 - [BC - Insight] A malicious coordinator can run multiple DKG coordination in parallel and manipu
- 38223 - [BC - Insight] Attackers can disrupt the tag order of gossip messages to bypass signature verif
- 38030 - [BC - Insight] Coordinator can be crashed by signers on DKG
- 38671 - [BC - Insight] Signer key rotation is not possible due to deadlock between submitting key rotat
Reports by Type
Blockchain/DLT
- 38516 - [BC - High] Signer can censor transactions and halt the network by providing an invalid nonce o
- 37545 - [BC - Medium] Deposits with a lock_time of 16 cannot be processed
- 38003 - [BC - Medium] A malicious coordinator calling Emily::update_deposits can make the entire Sign
- 37479 - [BC - High] A single signer can lock users' funds by not notifying other signers of the execute
- 38398 - [BC - High] Malicious Signers can initiate repeated contract calls to cause the multi-sign wall
- 37530 - [BC - Insight] Deposits can be completely DoSed due to incorrect transaction construction
- 38160 - [BC - Insight] Governance calling sbtc-registry.update-protocol-contract may cause Stacks' ev
- 37500 - [BC - Low] Blocklist can be circumvented due to incorrect blocking logic in request_decider::c
- 38690 - [BC - Insight] A malicious coordinator can run multiple DKG coordination in parallel and manipu
- 38270 - [BC - Medium] A signer can send a large number of junk WstsNetMessage::NonceRequest through P
- 38223 - [BC - Insight] Attackers can disrupt the tag order of gossip messages to bypass signature verif
- 37470 - [BC - Medium] SBTC Signers do not page through pending deposit requests making it trivially eas
- 38551 - [BC - Medium] A signer can request stacks tx nonces in batches in advance and then DoS other si
- 38111 - [BC - High] Attackers can send a very large event in a Stacks block so that the Signer can neve
- 38477 - [BC - High] A single signer can abort every attempted signing round by providing an invalid pac
- 38460 - [BC - Low] The coordinator can set a higher BTC tx fee than the current network to make users t
- 37384 - [BC - Medium] Attacker can front-run call to emily api with incorrect data, preventing legit us
- 38133 - [BC - Medium] A rogue Signer can censor any deposit request from being processed and fullfilled
- 38053 - [BC - High] A single signer can continuously prevent signatures from being finalized, halting n
- 38740 - [BC - High] The missing check in Deposits::DepositScriptInputs::parse() permits losing funds by
- 38030 - [BC - Insight] Coordinator can be crashed by signers on DKG
- 38028 - [BC - Low] There is a Partial Network Degradation Due to DynamoDB GSI Throttling Under High Tra
- 38458 - [BC - Critical] The coordinator can submit empty BTC transactions to drain BTC tokens in the mu
- 38671 - [BC - Insight] Signer key rotation is not possible due to deadlock between submitting key rotat
- 38392 - [BC - High] Signer can steal STX tokens in multi-sign wallet by setting a high stacks tx fee
- 37861 - [BC - Critical] SBTC Signer WSTS implementation allows nonce replays such that a malicious sign
- 38605 - [BC - Low] Lack of fee_rate/last_fees validation in handle_bitcoin_pre_sign_request ebables rog
- 38582 - [BC - High] The BitcoinCoreClient::get_tx_info does not support coinbase transactions, which
- 37814 - [BC - High] Signers can crash other signers by sending an invalid DkgPrivateShares due to mis
- 37777 - [BC - Medium] Emily.create_deposit can overwrite any deposit to the Pending state
- 37811 - [BC - High] Missing length check when parsing SignatureShareRequest in the signers allows the
- 37718 - [BC - High] Key rotations bricks the system due to incorrect aggregate_key being used to spen