{"type": "project", "title": "Audit, improve and port fundamental Avalanche tools to OpenBSD/adJ", "website": "https://github.com/vtamara/avalanchego/wiki/Audit,-improve-and-port-fundamental-Avalanche-tools-to-OpenBSD-adJ", "createdAt": 1712849601333, "userGithub": "vtamara", "credentials": {"github": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..i2XFs36VhIpeopCJku3Hv1MBN5s29G7wVQuChcqiRTScpGP15XZNeaLRtSDymD3WzqM6q501BT7hqlVpXfs0CA", "type": "Ed25519Signature2018", "created": "2024-04-11T14:27:06.110Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-11T14:27:06.110Z", "expirationDate": "2024-07-10T14:27:06.110Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:jMgNV9IRChHicb6fkbTaU3tMlmNatPeEFuRR60w3cWk=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextGithubOrg#pasosdeJesus#701221"}}, "twitter": {"type": ["VerifiableCredential"], "proof": {"jws": "eyJhbGciOiJFZERTQSIsImNyaXQiOlsiYjY0Il0sImI2NCI6ZmFsc2V9..-pQpaAJ_23UpTYCl240f2o-9DDjyVr2aFKY7fD_D96Wg0X0LaTut8sbACl2nBkowA1eZ0u9ySVsWhf29AoN7Cg", "type": "Ed25519Signature2018", "created": "2024-04-11T14:26:29.316Z", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC#z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC"}, "issuer": "did:key:z6MkghvGHLobLEdj1bgRLhS4LPGJAvbMA1tn2zcRyqmYU5LC", "@context": ["https://www.w3.org/2018/credentials/v1"], "issuanceDate": "2024-04-11T14:26:29.316Z", "expirationDate": "2024-07-10T14:26:29.316Z", "credentialSubject": {"id": "did:pkh:eip155:1:0x2e2c4AC19c93d0984840cDD8E7f77500e2ef978e", "hash": "v0.0.0:tLyuTj+RMorKGOt7Uf0HpoVIKz8Ao66i36v9KTSt30Q=", "@context": [{"hash": "https://schema.org/Text", "provider": "https://schema.org/Text"}], "provider": "ClearTextTwitter#pasosdeJesus"}}}, "description": "We propose to improve the security of the Avalanche network as a whole by:\n\n1. Auditing the source code of the Avalanche tools and some of the libraries on which they depend. To audit we will follow the [methodology of OpenBSD](<https://www.openbsd.org/security.html>)\n2. Porting the libraries and the fundamental avalanche tools to OpenBSD/adJ (at least `avalanchego`, `subnet-evm`, `coreth`, `avalanche-network-runner`, `precompile-evm` and `avalanche-cli`)\n3. On OpenBSD/adJ run the tests of the Avalanche tools and use them with different use cases (including a validator and developing dApps) and with loads as close as production as possible  to discover runtime failures that could point to security flaws. \n4. Report the problems found and recommend ways to improve and/or propose Pull Requests to fix them.\n\nUp to now we have been advancing in the porting effort, and it has shown fruits, in particular in the library [supranational/blst](https://github.com/supranational/blst) used by Avalanchego and that was improved as a result of our testing on OpenBSD/adJ.  See its security improvement at [commit dae1f](https://github.com/supranational/blst/commit/dae1f9416f157112be1dc46209a32ed5414fd525) and [commit 6cca1](https://github.com/supranational/blst/commit/6cca12ac0c10ca8752d1788ee44891261c0f272a) --a constant table  required for the cryptographic BLS12-381 signature library now is in a section for constants (.rodata) making more difficult for an attacker to modify it after avalanchego starts), see the details of our report and feedback at the [issue 206](https://github.com/supranational/blst/issues/206).\n\n\nPlease see more about this project in [its description in the Forum](https://forum.avax.network/t/audit-improve-and-port-fundamental-avalanche-tools-to-openbsd-adj-round-1/2098)  and in  [its status page](https://github.com/vtamara/avalanchego/wiki/Audit,-improve-and-port-fundamental-Avalanche-tools-to-OpenBSD-adJ)\n", "projectGithub": "pasosdeJesus", "projectTwitter": "pasosdeJesus"}
Audit, improve and port fundamental Avalanche tools to OpenBSD/adJ
We propose to improve the security of the Avalanche network as a whole by:

1. Auditing the source code of the Avalanche tools and some of the libraries on which they depend. To audit we will follow the [methodology of OpenBSD](<https://www.openbsd.org/security.html>)
2. Porting the libraries and the fundamental avalanche tools to OpenBSD/adJ (at least `avalanchego`, `subnet-evm`, `coreth`, `avalanche-network-runner`, `precompile-evm` and `avalanche-cli`)
3. On OpenBSD/adJ run the tests of the Avalanche tools and use them with different use cases (including a validator and developing dApps) and with loads as close as production as possible  to discover runtime failures that could point to security flaws. 
4. Report the problems found and recommend ways to improve and/or propose Pull Requests to fix them.

Up to now we have been advancing in the porting effort, and it has shown fruits, in particular in the library [supranational/blst](https://github.com/supranational/blst) used by Avalanchego and that was improved as a result of our testing on OpenBSD/adJ.  See its security improvement at [commit dae1f](https://github.com/supranational/blst/commit/dae1f9416f157112be1dc46209a32ed5414fd525) and [commit 6cca1](https://github.com/supranational/blst/commit/6cca12ac0c10ca8752d1788ee44891261c0f272a) --a constant table  required for the cryptographic BLS12-381 signature library now is in a section for constants (.rodata) making more difficult for an attacker to modify it after avalanchego starts), see the details of our report and feedback at the [issue 206](https://github.com/supranational/blst/issues/206).


Please see more about this project in [its description in the Forum](https://forum.avax.network/t/audit-improve-and-port-fundamental-avalanche-tools-to-openbsd-adj-round-1/2098)  and in  [its status page](https://github.com/vtamara/avalanchego/wiki/Audit,-improve-and-port-fundamental-Avalanche-tools-to-OpenBSD-adJ)

Audit, improve and port fundamental Avalanche tools to OpenBSD/adJ