Least Authority Initial Audit Suggestion 1

[ianconsolata]

Suggestion 1: Update and Maintain Dependencies

Location

• power-voting/package.json
• power-voting-backend/go.mod
• power-oracle-node/backend/go.mod

Synopsis

Analyzing package.json for dependency versions using Npm Audit shows 19 vulnerabilities (1 low, 15 moderate, 3 high). Additionally, running the depcheck command shows a large number of unused dependencies, and analysis with nancy revealed several Go dependency issues of various severity. We analyzed each reported issue and found that only one dependency - protobuf < 1.33.0 - has possible impact in the Power Voting scheme. Susceptible versions could crash or hang a node via malicious JSON payloads.

Mitigation

We recommend upgrading the protobuf version to the 1.33.0 version, or higher, if possible. As of writing this report, version 1.5.4 is the current latest release version for Protobuf. We additionally recommend following a process that emphasizes secure dependency usage to avoid introducing vulnerabilities to the Voting contracts and to mitigate supply-chain attacks, which includes:

• Manually reviewing and assessing currently used dependencies;
• Upgrading dependencies with known vulnerabilities to patched versions with fixes;
• Replacing unmaintained dependencies with secure and battle-tested alternatives, if possible;
• Pinning dependencies to specific versions, including pinning build-level dependencies in the
• package.json file to a specific version;
• Only upgrading dependencies upon careful internal review for potential backward compatibility
  issues and vulnerabilities; and
• Including automated dependency auditing reports in the project’s CI/CD workflow.

[joekingss]

#21 updated power-voting/package.json dependencies.

[mor9x00]

#8 protobuf version already updated to 1.33

[joekingss]

@ianconsolata could you help to config the CI/CD workflow to include automated dependency auditing reports? Thanks

[ianconsolata]

@hexianglinss sorry, just seeing this comment now. What exactly do you need my support on? Was this related to the request to give your team admin privileges so you could update the secrets, or something else?

[joekingss]

It doesn't matter. Thanks for giving us the admin privileges. As our server cannot be accessed without a VPN, could you provide us a server with public IP, a domain name point to that IP and a HTTPS certificate? So that we can config the CD workflows. Thanks!

[ianconsolata]

Ok, I will close this issue then, and we can continue the discussion about CD in #84