{"id":418,"date":"2022-11-04T12:00:17","date_gmt":"2022-11-04T10:00:17","guid":{"rendered":"https:\/\/ackeeblockchain.com\/blog\/?p=418"},"modified":"2024-05-16T13:45:57","modified_gmt":"2024-05-16T11:45:57","slug":"neon-labs-neon-evm-audit-summary","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/neon-labs-neon-evm-audit-summary\/","title":{"rendered":"Neon Labs: Neon EVM Audit Summary"},"content":{"rendered":"<p>The <strong>Neon EVM<\/strong> is a tool that<strong> allows Ethereum-like transactions<\/strong> to be processed on Solana, taking full advantage of the functionality native to Solana, including the ability to execute transactions in parallel. As such, the Neon EVM allows dApps to operate with the <strong>low gas fees, high transaction speed, and high throughput of Solana<\/strong>, while also offering access to the growing Solana market.<\/p>\n<p><span style=\"font-weight: 400;\"><a href=\"https:\/\/neon-labs.org\/\" target=\"_blank\" rel=\"noopener\">Neon Labs<\/a> engaged <a href=\"https:\/\/ackeeblockchain.com\/\">Ackee Blockchain<\/a>\u00a0to review and <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/audit\/\">audit<\/a> their <\/span>Neon EVM contract between <strong>September 26 and November 4, 2022<\/strong>. The entire audit process was conducted with a total time commitment of<strong> 33 <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/engineering-days\/\">engineering days<\/a><\/strong>. We now publish a summary of our results.<!--more--><\/p>\n<h4><b>Methodology<\/b><\/h4>\n<div class=\"page\" title=\"Page 7\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>The beginning of the audit was dedicated to understanding the Neon EVM <a href=\"https:\/\/ackeeblockchain.com\/blog\/glossary\/solana-program\/\">program<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p><span style=\"font-weight: 400;\">Reviewing the specifications, sources, and instructions provided to us is essential to ensure we understand the project&#8217;s size, scope, and functionality. This is followed by a detailed manual code review, which is the process of reading the source code line by line to identify potential vulnerabilities.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">When the code review is complete, we run client&#8217;s tests to ensure the system works as expected and potentially write missing unit or fuzzy tests using our testing framework <\/span><a href=\"https:\/\/github.com\/Ackee-Blockchain\/trdelnik\"><span style=\"font-weight: 400;\">Trident<\/span><\/a><span style=\"font-weight: 400;\">. We also deploy programs locally and try to attack and break the system.\u00a0<\/span><\/p>\n<h4><b>Scope\u00a0<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">We audited commit <\/span><em>eeed4c4fd55e09d30a6a7ae4253a31bdd0bb7a35<\/em><em>\u00a0<\/em><span style=\"font-weight: 400;\">of the <a href=\"https:\/\/github.com\/neonlabsorg\/neon-evm\/commit\/eeed4c4fd55e09d30a6a7ae4253a31bdd0bb7a35\" target=\"_blank\" rel=\"noopener\">neonlabsorg\/neon-evm<\/a><\/span> repository and commit <em>49bd848e08502010f6d5f31aa5cea4dac65eaad7 <\/em><a href=\"https:\/\/github.com\/neonlabsorg\/evm\/commit\/49bd848e08502010f6d5f31aa5cea4dac65eaad7\" target=\"_blank\" rel=\"noopener\">neonlabsorg\/evm<\/a> repository.<\/p>\n<p><span style=\"font-weight: 400;\">During the security review<\/span><span style=\"font-weight: 400;\">, we paid particular attention to the following questions:<\/span><\/p>\n<div class=\"page\" title=\"Page 10\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<ul>\n<li>Is the correctness of the custom EVM ensured?<\/li>\n<\/ul>\n<div class=\"page\" title=\"Page 10\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<ul>\n<li>Do the program correctly use dependencies or other programs they rely on (e.g., SPL dependencies)?<\/li>\n<li>\n<div class=\"page\" title=\"Page 10\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p>Is the code vulnerable to any form of unintended manipulation?<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h4><b>Findings<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Here we present our findings.<\/span><\/p>\n<h5><b>Critical severity\u00a0<\/b><\/h5>\n<div class=\"page\" title=\"Page 13\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><span style=\"font-weight: 400;\">No critical severity issues were found.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h5><b>High severity\u00a0<\/b><\/h5>\n<p><span style=\"font-weight: 400;\">No high severity issues were found.<\/span><\/p>\n<h5><b>Medium severity<\/b><\/h5>\n<div class=\"page\" title=\"Page 13\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<div class=\"page\" title=\"Page 11\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>M1:<\/strong> Selfdestruct early evaluation<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"page\" title=\"Page 14\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>M2: <\/strong>The emulation of the <span style=\"color: #0000ff;\">spl_associated_token_program<\/span> will not work<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h5><b>Low severity<\/b><\/h5>\n<div class=\"page\" title=\"Page 14\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>L1: <\/strong>Precompiled <span style=\"color: #0000ff;\">ecrecover<\/span> behaves incorrectly<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h5><b>Warning severity\u00a0<\/b><\/h5>\n<div class=\"page\" title=\"Page 11\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>W1:<\/strong> Differences in the system program emulation<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h5><b>Informational severity\u00a0<\/b><\/h5>\n<div class=\"page\" title=\"Page 14\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<div class=\"page\" title=\"Page 11\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>I1:<\/strong> Redundant account check<\/p>\n<div class=\"page\" title=\"Page 12\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>I2:<\/strong> Unnecessary owner check<\/p>\n<div class=\"page\" title=\"Page 12\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>I3:<\/strong> Unnecessary instruction argument<\/p>\n<div class=\"page\" title=\"Page 12\">\n<div class=\"section\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>I4:<\/strong> Unnecessary holder owner validation<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<h4><b>Conclusion<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Our review resulted in <strong>8 findings<\/strong> ranging from <\/span><i><span style=\"font-weight: 400;\">Informational<\/span><\/i><span style=\"font-weight: 400;\"> to <em>Medium<\/em><\/span><span style=\"font-weight: 400;\">\u00a0severity. <\/span><\/p>\n<p>Since this was not a classic Solana program, two auditors were involved in the audit &#8211; one Solana auditor who checked the evm_loader and one Ethereum auditor who verified the implementation of the EVM itself.<\/p>\n<div class=\"page\" title=\"Page 9\">\n<div class=\"layoutArea\">\n<div class=\"column\">\n<p><strong>We recommended Neon Labs to:<\/strong><\/p>\n<ul>\n<li>address all reported issues.<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p><b>Update:<\/b> On <strong>November 1<\/strong><b>, 2022<\/b>, Neon Labs provided an updated codebase that addresses the reported issues. All of the findings were fixed, except I4. A detailed discussion of the exact status of each issue can be found in the the report.<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: left;\"><b>Ackee Blockchain&#8217;s full <em>Neon EVM contract<\/em>\u00a0audit report with a more detailed description of all findings and recommendations can be found <\/b><a href=\"https:\/\/github.com\/neonlabsorg\/neon-evm\/blob\/develop\/audit\/20221104-AckeeBlockchain.pdf\" target=\"_blank\" rel=\"noopener\"><strong>here<\/strong><\/a><b>.<\/b><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">We were delighted to audit<\/span><b> Neon Labs<\/b><span style=\"font-weight: 400;\">\u00a0and look forward to working with them again.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Neon EVM is a tool that allows Ethereum-like transactions to be processed on Solana, taking full advantage of the functionality native to Solana, including the ability to execute transactions in parallel. As such, the Neon EVM allows dApps to operate with the low gas fees, high transaction speed, and high throughput of Solana, while also offering access to the growing Solana&hellip;<\/p>\n","protected":false},"author":11,"featured_media":428,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,5,113],"tags":[21,27,33,79,6],"class_list":["post-418","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-solana","category-trident","tag-audit","tag-blockchain","tag-evm","tag-neon","tag-solana"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/12\/Axelar2-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2022\/12\/Axelar2-600x600.png","author_info":{"display_name":"Andrea Nov\u00e1kov\u00e1","author_link":"https:\/\/ackee.xyz\/blog\/author\/andrea-novakova\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=418"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/418\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/428"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}