Immunefi Audit CompetitionsStacks II Attackathon
Reports by Severity
High
- 40692 - [BC - High] Calling multiple withdrawals on a single transaction causes Signers to halt and the network to stop
- 40806 - [BC - High] Users can submit deposits containing large reclaim_scripts to DoS Emily and Signers
- 42747 - [BC - High] Large BTC transactions with many sbtc deposits can permanently crash/halt all signers
- 42752 - [BC - High] Signer can be DOSed through their libp2p component
Medium
- 40655 - [BC - Medium] Malicious signers can give different votes to other Signers to prevent sBTC withdrawal
- 40731 - [BC - Medium] A malicious signer can force a panic in the coordinator by sending DkgFailure::BadPrivateShares with an invalid signer ID
- 41111 - [BC - Medium] A malicious signer could manipulate withdrawal decisions preventing accepted and rejected withdrawals from getting confirmed on Stacks chain
- 42404 - [BC - Medium] A signer can OOM kill other signers during DKG verification
- 42773 - [BC - Medium] Signers can be compromised by a libp2p DoS attack
Low
Insight
- 41202 - [BC - Insight] A malicious signer can force a failure of the signature round by providing a key ID they don't own
- 41340 - [BC - Insight] There is insecure Exposure of TRUSTED_REORG_API_KEY in Lambda and is can lead to Potential sBTC Withdrawal Manipulation
- 41597 - [BC - Insight] Emily server can crash their connected Stacks node when processing a large number of events
- 42750 - [BC - Insight] Subtraction overflow risk in WSTS FIRE coordinator
Reports by Type
Blockchain/DLT
- 40692 - [BC - High] Calling multiple withdrawals on a single transaction causes Signers to halt and the network to stop
- 40655 - [BC - Medium] Malicious signers can give different votes to other Signers to prevent sBTC withdrawal
- 40731 - [BC - Medium] A malicious signer can force a panic in the coordinator by sending DkgFailure::BadPrivateShares with an invalid signer ID
- 40770 - [BC - Low] Unvalidated withdrawal events allow data manipulation and denial of service in Emily
- 41014 - [BC - Low] The signer can submit multi-tx first to make the coordinator's submission fail
- 40806 - [BC - High] Users can submit deposits containing large reclaim_scripts to DoS Emily and Signers
- 41111 - [BC - Medium] A malicious signer could manipulate withdrawal decisions preventing accepted and rejected withdrawals from getting confirmed on Stacks chain
- 41202 - [BC - Insight] A malicious signer can force a failure of the signature round by providing a key ID they don't own
- 41340 - [BC - Insight] There is insecure Exposure of TRUSTED_REORG_API_KEY in Lambda and is can lead to Potential sBTC Withdrawal Manipulation
- 41597 - [BC - Insight] Emily server can crash their connected Stacks node when processing a large number of events
- 42404 - [BC - Medium] A signer can OOM kill other signers during DKG verification
- 42747 - [BC - High] Large BTC transactions with many sbtc deposits can permanently crash/halt all signers
- 42750 - [BC - Insight] Subtraction overflow risk in WSTS FIRE coordinator
- 42752 - [BC - High] Signer can be DOSed through their libp2p component
- 42764 - [BC - Low] A BTC wallet on signer blocklists can cause network DoS
- 42773 - [BC - Medium] Signers can be compromised by a libp2p DoS attack