ThorChain Weekly Dev Update #101
THORChain released Weekly Dev Update for Week 101: Updated Plan/Timeline, Security Audits, Bounty Program, MCCN Updates, Community Updates.
Review of the second ETH exploit showed a weakness between ETH Router and Bifrsot and has shown the need for greater scrutiny of the code. Two security audit firms engaged to audit code for a formal review, whitehat hackers engaged for an informal review and bug bounty program released for incentives and responsible disclosure. A plan forward has been laid out and a rough timeline to set expectation delivered.
🔹Planned Path Forward
1. Evaluate (internal and external) all code-paths relating to MsgDeposit(bond/unbond/leave/swap/add/remove, using THOR.RUNE) which will be the only allowed action when the chain restarts.
2. Once externally signed off (NineRealms OpsSec team to give the ok) chain will be restarted in a particular fashion: make update, but quickly kill the Bifrost (to stop external chain observations_. This is because the ChainHalt feature is not yet live, so the network needs to be isolated from external inbounds during the 2/3rds->100% update window.
3. With the chain restarted, block rewards will flow again, paying Nodes and LPs. Nodes (Active and Standby) will be backpaid for the days the chain was halted. A restarted chain means updates can be pushed out to address bugs and add security features — with inbounds halted.
4. Ragnarok SCCN — this is a liability that needs to be addressed whilst audits are underway.
5. Halborn and Tail of Bits to pass review on successive chain clients, as well as swap/add liquidity code paths. Once passed, chain clients will be successively restarted. BNB, then UTXO, then ETH being last.
6. ETH will finally be addressed. The decision to drop ERC-20’s (or not) will be made here.
7. Network fully operational, Audits completed.
🔹Timeline
Draft timeline created. All timelines are indicative and the team is seeking to expedite as much as possible. Simple Gantt-like view of stages & activities; https://www.notion.so/tc-contributor/8c08daa568f149a0be096a626357233c?v=323951fdad3444c8ac08a76eea31f456
🔹Major streams of work & action items
🔹Security Audits / Review Update
Halborn and Tail of Bits to conduct security audits for a structuredreview of the code. Halboun Schedule
Security code walk through for whitehat hackers and auditors conducted allowing unstructured review of the code.
Halborn Incident Analysis of the 2nd ETH Hack can be found here.
Bounty Program Released
Formal Bounty Program run by Immuniefy and Nine Realms was released. Up to $500,000 will be awarded. Bugs can be submitted at https://bugs.immunefi.com. Nine Realms will assist with triage.
Read the full details here https://medium.com/immunefi/thorchain-joins-immunefi-with-500-000-bug-bounty-52a5ddcb2713.
4000 rune bounty accounced for bare metal guide shell/secrets access issues. See https://hildisviniottar.medium.com/vultr-bare-metal-thorchain-validator-setup-guide-a743c8e7561c , Full details here. Disclosure of bugs to https://bugs.immunefi.com. This bounty Ends 31 Aug 2021.
Last call for SCCN (BEPSWAP) before Ragnarok!
Very soon THORChain will move to Ragnarok Single Chain Chaosnet. The time is now to withdraw any funds.
🔹Post-mortem: ETH Router Exploits 1 & 2, and premature Return To Trading Incident
Post-mortum of Exploits, lessons learnt and detaling THORChain’s 5 Pronged Recovery Plan Update:
1) Stop and Audit (Halborn + Trail Of Bits)
2) Red-teams (Halborn + THORSec team)
3) Bounty Program (Immunify)
4) Harden the Protocol (6 new features added)
5) Insure the TVL. Tidal, more coming.
About THORChain
THORChain is the first decentralized protocol to actively address liquidity by incentivizing users to stake liquidity rather than store assets in cold-wallets or completely off-line.
📰 INFO:
https://medium.com/thorchain/weekly-dev-update-101-c8e556bd06c4
