V1.1.7 internal audit4.1 #121
Conversation
audits/README.md
Outdated
| @@ -10,6 +10,8 @@ contracts is located in this folder: [internal audit 2](https://github.com/valor | |||
| An internal audit with a focus on one-shot upgrade and operating services with signatures | |||
| contracts is located in this folder: [internal audit 3](https://github.com/valory-xyz/autonolas-registries/blob/main/audits/internal3). | |||
|
|
|||
| An internal audit with a focus on "staking" | |||
There was a problem hiding this comment.
| An internal audit with a focus on "staking" | |
| An internal audit with a focus on Service Staking |
| If you wish, you can fight, for example, using this method | ||
| hash(multisig.code) vs well-know hash | ||
| ``` | ||
| Is it possible to replace the multisig with some kind of fake one without losing the opportunity to receive rewards? <br> |
There was a problem hiding this comment.
Once the service has been staked, there is no possibility to update the service multisig.
There was a problem hiding this comment.
I see, good point. Added this in registries vulnerabilities list as well!
There was a problem hiding this comment.
So basically for staking to be safe we first need to upgrade the protocol to ensure all services use Safe multisigs.
There was a problem hiding this comment.
@DavidMinarsch There's no immediate urgency for an upgrade. Specifically, we can perform a direct check on the staking contract when a service is staked under this initial version. Subsequently, we can consider upgrading the GnosisSafeSameAddressMultisig
There was a problem hiding this comment.
Yes, the verification in this contract will be enough to close the problem now.
Then we will need to add this check to old contracts.
Everything is as @mariapiamo said. @kupermind has already made such a fix in post-audit PR.
There was a problem hiding this comment.
We will do it in the staking contract, however it would be good to update GnosisSafeSameAddressMultisig contract at some point to check for the multisig proxy code.
Internal audit based on v.1.1.7 focused on staking contracts.