Stacks II Attackathon

Reports by Severity

High
  • #42747 [BC-High] Large BTC transactions with many sbtc deposits can permanently crash/halt all signers

  • #40692 [BC-High] Calling multiple withdrawals on a single transaction causes Signers to halt and the network to stop

  • #42752 [BC-High] Signer can be DOSed through their libp2p component

  • #40806 [BC-High] Users can submit deposits containing large `reclaim_scripts` to DoS Emily and Signers

Medium
  • #42773 [BC-Medium] Signers can be compromised by a libp2p DoS attack

  • #40731 [BC-Medium] A malicious signer can force a panic in the coordinator by sending `DkgFailure::BadPrivateShares` with an invalid signer ID

  • #42404 [BC-Medium] A signer can OOM kill other signers during DKG verification

  • #40655 [BC-Medium] Malicious signers can give different votes to other Signers to prevent sBTC withdrawal

  • #41111 [BC-Medium] A malicious signer could manipulate withdrawal decisions preventing accepted and rejected withdrawals from getting confirmed on Stacks chain

Low
  • #41014 [BC-Low] The signer can submit multi-tx first to make the coordinator's submission fail

  • #42764 [BC-Low] A BTC wallet on signer blocklists can cause network DoS

  • #40770 [BC-Low] Unvalidated withdrawal events allow data manipulation and denial of service in Emily

Insight
  • #41202 [BC-Insight] A malicious signer can force a failure of the signature round by providing a key ID they don't own

  • #41597 [BC-Insight] Emily server can crash their connected Stacks node when processing a large number of events

  • #42750 [BC-Insight] Subtraction overflow risk in WSTS FIRE coordinator

  • #41340 [BC-Insight] There is insecure Exposure of TRUSTED_REORG_API_KEY in Lambda and is can lead to Potential sBTC Withdrawal Manipulation

Reports by Type

Blockchain/DLT
  • #41014 [BC-Low] The signer can submit multi-tx first to make the coordinator's submission fail

  • #42747 [BC-High] Large BTC transactions with many sbtc deposits can permanently crash/halt all signers

  • #41202 [BC-Insight] A malicious signer can force a failure of the signature round by providing a key ID they don't own

  • #42773 [BC-Medium] Signers can be compromised by a libp2p DoS attack

  • #40692 [BC-High] Calling multiple withdrawals on a single transaction causes Signers to halt and the network to stop

  • #41597 [BC-Insight] Emily server can crash their connected Stacks node when processing a large number of events

  • #42752 [BC-High] Signer can be DOSed through their libp2p component

  • #40731 [BC-Medium] A malicious signer can force a panic in the coordinator by sending `DkgFailure::BadPrivateShares` with an invalid signer ID

  • #42764 [BC-Low] A BTC wallet on signer blocklists can cause network DoS

  • #42404 [BC-Medium] A signer can OOM kill other signers during DKG verification

  • #40770 [BC-Low] Unvalidated withdrawal events allow data manipulation and denial of service in Emily

  • #42750 [BC-Insight] Subtraction overflow risk in WSTS FIRE coordinator

  • #40806 [BC-High] Users can submit deposits containing large `reclaim_scripts` to DoS Emily and Signers

  • #40655 [BC-Medium] Malicious signers can give different votes to other Signers to prevent sBTC withdrawal

  • #41340 [BC-Insight] There is insecure Exposure of TRUSTED_REORG_API_KEY in Lambda and is can lead to Potential sBTC Withdrawal Manipulation

  • #41111 [BC-Medium] A malicious signer could manipulate withdrawal decisions preventing accepted and rejected withdrawals from getting confirmed on Stacks chain

Was this helpful?