Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Component: Engine
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?1-cf-lp2-cf-pools3-cf-swapping4-cf-witnesser
5-engineComponent: EngineWitnessing and prewitnessing external eventsBroadcasting to other chains
Audit ResultsSummary

Component: Engine

The engine component is responsible for observing events from external chains and submitting signed extrinsics to witness them and contribute to the consensus of the state chain. Data relayed from external chains include swap requests as well as information about current gas (or gas-equivalent) cost.

It also observes and acts on events originating from the state chain; these events can be categorized in two broad categories:

  • Key management — events that require to handle keygen, signing, or key handover (the latter is only applicable to BTC)

  • Transaction broadcast — events that request a transaction to be broadcast to an external chain

Additionally, the engine provides a health-check endpoint and an endpoint that provides various activity metrics.

Finally, the engine is responsible for monitoring the state chain to handle multi-sig ceremonies; it also has a component that handles peer-to-peer communication with other engine instances. These parts of the code were not part of the scope of this audit.

Zellic © 2024Back to top ↑