Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Radix>Threat Model>Package
GeneralOverview
Findings
High (1)
Medium (2)
Low (2)
Informational (1)
DiscussionUnique Characteristics of Radix
Threat ModelWhat are threat models?
1-native-blueprintsModule: Resource blueprintsResourcesConsensus managerFungible and nonfungible proofsAuthorization zonePackageFungible bucketsFungible vaultsFungible resource managersValidatorAccount lockerWorktopAccountLiquidity poolsAccess controller
2-runtime3-transactions4-kernel
Audit ResultsAssessment Results

Package

The package native blueprint contains functions that allow users of Radix to publish their own blueprints.

The functions in this blueprint are not callable directly. They must be called through either the transaction processor (when publishing a WASM blueprint, which is a user-defined blueprint) or through a system transaction (when publishing a native blueprint).

When publishing a user-defined WASM blueprint, there are rigorous checks to ensure that it adheres to certain criteria, which ensures that it is compatible with the Radix engine. Additionally, the WASM code is instrumented with instruction and stack-metering code that ensures that gas is appropriately consumed when executing WASM instructions and using the WASM VM stack.

We have extensively audited the user-defined blueprint publishing flow, and there was one gas-consumption--related finding that was found as a result of this. See finding ref↗.

Zellic © 2025Back to top ↑