MetaMask Snap Audit Report For Demystify

Management Summary

Demystify contacted Sayfer Security in order to perform a security audit on their MetaMask Snap in July 2023. It involves a process of probing and exploiting security vulnerabilities in the Snap to assess its resilience against malicious activities. The test aims to identify weaknesses in the Snap’s code, configuration, or integrations, ensuring the security of user assets and data.

Before assessing the above services, we held a kickoff meeting with the Demystify technical team and received an overview of the system and the goals for this research.

During the audit we discovered 3 potential vulnerabilities which were addressed by the Demystify team.

Demystify Metamask snap has passed this security audit and we can attest that the security system is competent.

During the audit, we evaluated the security of Demystify Snap using the OWASP WSTG standard. In total, we ran 97 test scenarios in 12 different domains. Demystify Snap scored 97 out of 97.

Risk Methodology

At Sayfer, we are committed to delivering the highest quality penetration testing to our clients. That’s why we have implemented a comprehensive risk assessment model to evaluate the severity of our findings and provide our clients with the best possible recommendations for mitigation.

Our risk assessment model is based on two key factors: IMPACT and LIKELIHOOD. Impact refers to the potential harm that could result from an issue, such as financial loss, reputational damage, or a non-operational system. Likelihood refers to the probability that an issue will occur, taking into account factors such as the complexity of the attack and the number of potential attackers.

By combining these two factors, we can create a comprehensive understanding of the risk posed by a particular issue and provide our clients with a clear and actionable assessment of the severity of the issue. This approach allows us to prioritize our recommendations and ensure that our clients receive the best possible advice on how to protect their business.

Risk is defined as follows:

Security Evaluation Methodology

Sayfer uses OWASP WSTG as our technical standard when reviewing web applications. After gaining a thorough understanding of the system we decided which OWASP tests are required to evaluate the system.

Security Assessment

After understanding and defining the scope, performing threat modeling, and evaluating the correct tests required in order to fully check the application for security flaws, we performed our security assessment.

Issue Table Description

Issue title

Description

Here we provide a brief description of the issue and how it formed, the steps we made to find or exploit it, along with proof of concept (if present), and how this issue can affect the product or its users. .

Mitigation

Suggested resolving options for this issue and links to advised sites for further remediation.

Security Assessment Findings

Incorrect Risk Score Calculation

Description

The demystify.network API returns a riskScore based on an internal, implicit classification. While this works fine for known malicious contracts, it doesn’t necessarily work for known but secure contracts.

Probably due to their communication with the malicious ones (which is logical since the example concerns USDT), the snap returns the highest possible Risk Score in relation to the Tether contract address, i.e. USDT.

We sent a request with the USDT contract:

This leads to the following warning in metamask.

Mitigation

The risk calculation method for such contracts should be improved over time when the algorithm gets better.

Usage of Encoded Hardcoded Values Without Description

Description

The Snap uses a base64-encoded endpoint for communication without any comment about what’s inside.

The relevant constant:

const TARGET =
'aHR0cHM6Ly9hcGkuZGVteXN0aWZ5Lm5ldHdvcmsvYWRkcmVzcy90aHJlYXRJbnRlbA
==';

Mitigation

Add a comment detailing the contents of the encoded variable.

Usage of Confusing “Magic Numbers”

Description

Snap is communicating with demystify.network API sending information regarding address, with which client’s account is trying to interact. Then, the API responds with data regarding the potential risks associated with that address, and if it is somehow malicious, percentTransactionByRisk, a table with three entries, is returned. However, only the third ([2]) element is used in the code. It may be difficult for the reader to deduct why the code is using only that part of the response, leaving the first two untouched.

As you can see, only the second element is used:

const { percentTransactionByRisk } = insights;
let highRisk = 'n/a';
if (percentTransactionByRisk !== undefined) {
highRisk = percentTransactionByRisk[2];
}

Mitigation

Leave a short comment explaining this oddity.

Appendix A: Security Evaluation Fixes

After a review by the Sayfer team, we certify that all the above-mentioned security issues have been addressed by the Demystify team.
Fixes commit: d029acbe2c657ae4c9c2318ee765096107de82c6