MetaMask Snap Audit Report For Tezos

Management Summary

Tezos contacted Sayfer Security in order to perform a security audit on Tezos MetaMask Snap in June 2023.

Before assessing the above services, we held a kickoff meeting with the Tezos technical team and received an overview of the system and the goals for this research.

Over the research period of 2 weeks, we discovered 4 findings in the system.

In conclusion, several fixes should be implemented following the report, but the system’s security posture is competent.

Security Evaluation Methodology

Sayfer uses OWASP WSTG as our technical standard when reviewing web applications. After gaining a thorough understanding of the system we decided which OWASP tests are required to evaluate the system.

Security Assessment

After understanding and defining the scope, performing threat modeling, and evaluating the correct tests required in order to fully check the application for security flaws, we performed our security assessment.

Issue Table Description

Issue title

Description

Here we provide a brief description of the issue and how it formed, the steps we made to find or exploit it, along with proof of concept (if present), and how this issue can affect the product or its users. .

Mitigation

Suggested resolving options for this issue and links to advised sites for further remediation.

Security Assessment Findings

Dependencies with Known Vulnerabilities

Description

The NPM audit returns multiple results for known vulnerabilities in the installed packages:

  npm audit
# npm audit report
engine.io 5.1.0 - 6.4.1
Severity: moderate
engine.io Uncaught Exception vulnerability -
https://github.com/advisories/GHSA-q9mw-68c2-j6m5
fix available via `npm audit fix`
node_modules/engine.io
socket.io 4.1.0 - 4.6.0-alpha1
Depends on vulnerable versions of engine.io
node_modules/socket.io
gatsby 1.9.130 - 4.25.7 || 5.4.0-next.0 - 5.9.1
Depends on vulnerable versions of gatsby-cli
Depends on vulnerable versions of latest-version
Depends on vulnerable versions of socket.io
node_modules/gatsby
got <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket -
https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix`
node_modules/package-json/node_modules/got
package-json <=6.5.0
Depends on vulnerable versions of got
node_modules/package-json
latest-version 0.2.0 - 5.1.0
Depends on vulnerable versions of package-json
node_modules/latest-version
update-notifier 0.2.0 - 5.1.0
Depends on vulnerable versions of latest-version
node_modules/update-notifier
gatsby-cli 1.1.27 - 4.25.0
Depends on vulnerable versions of update-notifier
node_modules/gatsby-cli
13
request *
Severity: moderate
Server-Side Request Forgery in Request -
https://github.com/advisories/GHSA-p8p7-x288-28g6
fix available via `npm audit fix`
node_modules/request
node-gyp <=7.1.2
Depends on vulnerable versions of request
node_modules/@npmcli/run-script/node_modules/node-gyp
@npmcli/run-script 1.1.1 - 1.8.6
Depends on vulnerable versions of node-gyp
node_modules/@npmcli/run-script
@lavamoat/allow-scripts <=2.3.0
Depends on vulnerable versions of @npmcli/run-script
node_modules/@lavamoat/allow-scripts
socket.io-parser 4.0.4 - 4.2.2
Severity: high
Insufficient validation when decoding a Socket.IO packet -
https://github.com/advisories/GHSA-cqmj-92xf-r6r9
fix available via `npm audit fix`
node_modules/socket.io-parser
webpack 5.0.0 - 5.75.0
Severity: high
Cross-realm object access in Webpack 5 -
https://github.com/advisories/GHSA-hc6q-2mpp-qw7j
fix available via `npm audit fix`
node_modules/webpack
yaml 2.0.0-5 - 2.2.1
Severity: high
Uncaught Exception in yaml - https://github.com/advisories/GHSA-f9xv-q969-pqx4
fix available via `npm audit fix`
node_modules/yaml-loader/node_modules/yaml 

We validated each one of them to make sure it is not affecting the production build, and found that even the high-severity ones do not have a direct effect on Tezos Snap. While this means there is no security risk right now, new features or new vulnerabilities might happen in the future.

Mitigation

The first step would be to update the packages to the versions where possible On a bigger picture level, there is a need for an automated system to alert about new vulnerabilities and a process should be in place to mitigate them when critical ones arise.

Magic Numbers

Description

During our assessment, we noticed the usage of seemingly arbitrary constants without explanatory comments:

In the case above, it’s hard to guess what is the reason for dividing by 1000 or multiplying by 257 without knowing how the protocol and the blockchain itself work

Mitigation

It’s considered good practice to give such hard-coded constants descriptive names, and if necessary, to add explanatory comments.

Alarming Metamask Prompt

Description

When installing Snap the following hard-to-understand metamask prompt appears:

Mitigation

It may not be possible for Tezos to change this rather scary prompt. However, since it may be of interest, we decided to include this issue as informational.

Alarming Metamask Prompt

Description

During our assessment, we noticed this comment, implying a certain uncertainty, which might point to an underlying bigger issue

We investigated and couldn’t verify what’s the issue here the comment referring about.

Mitigation

These comments should be changed or removed on the release version, or if there is a deeper issue here, the developers should update the logic of why this

Appendix A: Security Evaluation Fixes

After a review by the Sayfer team, we can confirm that all the vulnerabilities have been fixed by the Tezos team

Initial commit hash: 0e0d653b85cbd11365771ad9c2ee5726b10a7d26
Fixes commit hash: 0d0c9381a1107c54647d927d4fe99694f332e24d