Skip to content

Commit d3db1b1

Browse files
lfportallfportal
authored
[TD-1396] Immutable Signed Zone v2 Threat Model (#206)
1 parent f6dffe0 commit d3db1b1

File tree

1 file changed

+220
-1
lines changed

1 file changed

+220
-1
lines changed

‎audits/trading/202404-threat-model-immutable-signed-zone-v2.md

Lines changed: 220 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,233 @@
22

33
## Introduction
44

5-
This document is a threat model for the [Immutable Signed Zone (v2)](../../contracts/trading/seaport/zones/immutable-signed-zone/v2/README.md) contract built by Immutable.
5+
This threat model document for the [Immutable Signed Zone (v2)](../../contracts/trading/seaport/zones/immutable-signed-zone/v2/README.md) contract has been created in preparation for internal audit.
6+
7+
## Rationale
8+
9+
Immutable operates a global off-chain orderbook across Immutable zkEVM chains and relies on the Seaport protocol for on-chain settlement. The orderbook primarily intends to:
10+
11+
* Centralise liquidity
12+
* Enforce payment of fees (protocol, royalty, marketplace)
13+
14+
The [Immutable Signed Zone (v2)](../../contracts/trading/seaport/zones/immutable-signed-zone/v2/README.md) is an implementation of [SIP-7: Server-Signed Orders](https://github.com/ProjectOpenSea/SIPs/blob/main/SIPS/sip-7.md). The reasons Immutable has chosen this solution is:
15+
16+
* It requires orders to be known by the orderbook prior to fulfilment
17+
* It allows the orderbook to refuse fulfilment of an order at its discretion (e.g. for gasless cancellations, or compromised collections)
18+
* It allows for arbitrary logic to be defined off-chain and enforced on-chain (e.g. to enforce fees)
19+
20+
## Threat Model Scope
21+
22+
The threat model is limited to the following Solidity files at GitHash [`f6dffe08db1ff2daead3abe0c22b44d792ce5e59`](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2):
23+
24+
* [ImmutableSignedZoneV2.sol](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/ImmutableSignedZoneV2.sol)
25+
* [ZoneAccessControl.sol](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/ZoneAccessControl.sol)
26+
* [ZoneAccessControlEventsAndErrors.sol](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/ZoneAccessControlEventsAndErrors.sol)
27+
* [SIP5EventsAndErrors.sol](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP5EventsAndErrors.sol)
28+
* [SIP5Interface](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP5Interface.sol)
29+
* [SIP6EventsAndErrors](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP6EventsAndErrors.sol)
30+
* [SIP6Interface](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP6Interface.sol)
31+
* [SIP7EventsAndErrors](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP7EventsAndErrors.sol)
32+
* [SIP7Interface](https://github.com/immutable/contracts/blob/f6dffe08db1ff2daead3abe0c22b44d792ce5e59/contracts/trading/seaport/zones/immutable-signed-zone/v2/interfaces/SIP7Interface.sol)
33+
34+
## Background
35+
36+
Seaport: [Documentation](https://github.com/ProjectOpenSea/seaport/blob/20b84b94755ab4fcdd88735d5f8f1f578e07924a/docs/SeaportDocumentation.md) for v1.6 but relevant for v1.5 which Immutable's Seaport fork is based on.
37+
38+
SIP-7: [Documentation](https://github.com/ProjectOpenSea/SIPs/blob/main/SIPS/sip-7.md).
639

740
## Architecture
841

42+
### Top Level Architecture
43+
44+
The trading system on the Immutable platform is shown in the diagram below.
45+
46+
```mermaid
47+
flowchart LR
48+
client[Client] <-- 1. POST .../fulfillment-data ---> ob[Immutable Off-Chain\nOrderbook]
49+
client -- 2. fulfillAdvancedOrder ---> seaport[ImmutableSeaport.sol]
50+
seaport -- 3a. transferFrom --> erc20[IERC20.sol]
51+
seaport -- 3b. transferFrom --> erc721[IERC721.sol]
52+
seaport -- 3c. safeTransferFrom --> erc1155[IERC1155.sol]
53+
seaport -- 4. validateOrder --> Zone
54+
subgraph Zone
55+
direction TB
56+
zone[ImmutableSignedZoneV2.sol] --> AccessControlEnumerable.sol
57+
end
58+
```
59+
60+
The sequence of events is as follows:
61+
62+
1. The client makes a HTTP `POST .../fulfillment-data` request to the Immutable Orderbook, which will construct and sign an `extraData` payload to return to the client
63+
2. The client calls `fulfillAdvancedOrder` or `fulfillAvailableAdavancedOrders` on `ImmutableSeaport.sol` to fulfill an order
64+
3. `ImmutableSeaport.sol` executes the fufilment by transferring items between parties
65+
4. `ImmutableSeaport.sol` calls `validateOrder` on `ImmutableSignedZoneV2.sol`, passing it the fulfilment execution details as well as the `extraData` parameter
66+
1. `ImmutableSignedZoneV2.sol` validates the fulfilment execution details using the `extraData` payload, reverting if expectations are not met
67+
68+
### Immutable Signed Zone (v2) Design
69+
70+
Immutable Signed Zone (v2) is an implementation of the SIP-7 specification, supporting substandards 3, 4 and 6.
71+
72+
This section explains the security relevant aspects of the Immutable Signed Zone (v2) contract beyond the scope of the SIP-7 specification.
73+
74+
#### Roles
75+
76+
The Immutable Signed Zone (v2) supports the following roles:
77+
78+
* Default Admin
79+
* Creates and removes other administrators
80+
* First admin is assigned to the `address owner` param on the `constructor`
81+
* Zone Manager
82+
* Call the following configuration functions:
83+
* `addSigner`
84+
* `removeSigner`
85+
* `updateAPIEndpoint`
86+
* `updateDocumentationURI`
87+
88+
### Other Information
89+
90+
This section provides links to test plans and test code.
91+
92+
#### Test Plans and Test Code
93+
94+
The test plan is available here: [Test Plan for Immutable Signed Zone (v2)](../../test/trading/seaport/zones/immutable-signed-zone/v2/README.md). The test code is contained in the same directory at the test plan.
95+
96+
#### Continuous Integration
97+
98+
Each time a commit is pushed to a pull request, the [continuous integration loop executes](https://github.com/immutable/contracts/actions).
99+
100+
#### Building, Testing, Coverage and Static Code Analysis
101+
102+
For instructions on building the code, running tests, coverage, and Slither, see the [BUILD.md](https://github.com/immutable/contracts/blob/main/BUILD.md).
103+
9104
## Attack Surfaces
10105

106+
The following sections list attack surfaces evaluated as part of this threat modelling exercise.
107+
108+
### Externally Visible Functions
109+
110+
An attacker could formulate an attack in which they send one or more transactions that execute one or more of these functions.
111+
112+
#### ImmutableSignedZoneV2
113+
114+
This section describes the externally visible functions available in ImmutableSignedZoneV2. The list of functions and their function selectors was determined by the following command. The additional information was obtained by reviewing the code.
115+
116+
```
117+
forge inspect ImmutableSignedZoneV2 --pretty methods
118+
```
119+
120+
Functions that *change* state:
121+
122+
| Name | Function Selector | Access Control |
123+
| -------------------------------- | ----------------- | ------------------- |
124+
| `addSigner(address)` | eb12d61e | `ZONE_MANAGER_ROLE` |
125+
| `grantRole(bytes32,address)` | 2f2ff15d | Role admin |
126+
| `removeSigner(address)` | 0e316ab7 | `ZONE_MANAGER_ROLE` |
127+
| `renounceRole(bytes32,address)` | 36568abe | `msg.sender` |
128+
| `revokeRole(bytes32,address)` | d547741f | Role admin |
129+
| `updateAPIEndpoint(string)` | 297234d7 | `ZONE_MANAGER_ROLE` |
130+
| `updateDocumentationURI(string)` | 0a904f08 | `ZONE_MANAGER_ROLE` |
131+
132+
Functions that *do not change* state:
133+
134+
| Name | Function Selector |
135+
| -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
136+
| `DEFAULT_ADMIN_ROLE()` | a217fddf |
137+
| `ZONE_MANAGER_ROLE()` | c6e95ae7 |
138+
| `getRoleAdmin(bytes32)` | 248a9ca3 |
139+
| `getRoleMember(bytes32,uint256)` | 9010d07c |
140+
| `getRoleMemberCount(bytes32)` | ca15c873 |
141+
| `getSeaportMetadata()` | 2e778efc |
142+
| `hasRole(bytes32,address)` | 91d14854 |
143+
| `sip7Information()` | d600940e |
144+
| `supportsInterface(bytes4)` | 01ffc9a7 |
145+
| `validateOrder((bytes32,address,address,(uint8,address,uint256,uint256)[],(uint8,address,uint256,uint256,address)[],bytes,bytes32[],uint256,uint256,bytes32))` | 17b1f942 |
146+
147+
### Admin Roles
148+
149+
Accounts with administrative privileges could be used by attackers to facilitate attacks. This section analyses what each role can do.
150+
151+
#### Accounts with `DEFAULT_ADMIN` role on ImmutableSignedZoneV2 contract
152+
153+
This role is granted to the `owner` specified in the `constructor` of the contract. Accounts with the `DEFAULT_ADMIN` account can:
154+
155+
* Grant administrator roles to any account, including the `DEFAULT_ADMIN` role
156+
* Revoke administrator roles from any account, including the `DEFAULT_ADMIN` role
157+
* The `DEFAULT_ADMIN` role cannot be revoked from an account if it the only account with the `DEFAULT_ADMIN` role
158+
* Renounce the `DEFAULT_ADMIN` role for itself, unless it is the only account with the `DEFAULT_ADMIN` role
159+
160+
Exploiting this attack surface requires compromising an account with `DEFAULT_ADMIN` role.
161+
162+
#### Accounts with `ZONE_MANAGER` role on ImmutableSignedZoneV2 contract
163+
164+
An account with `ZONE_MANAGER` role can:
165+
166+
* Update API endpoint and documentation URI (no impact to Immutable system as these values are not utilised)
167+
* Add and remove SIP-7 signers, letting them control the result of order validation
168+
* Renounce the `ZONE_MANAGER` role for itself
169+
170+
Exploiting this attack surface requires compromising an account with `ZONE_MANAGER` role.
171+
172+
### SIP-7 Signers on the ImmutableSignedZoneV2 contract
173+
174+
Accounts added as SIP-7 signers could be used by attackers to facilitate attacks. Accounts added as an SIP-7 signer can:
175+
176+
* Control the result of order validation
177+
178+
Exploiting this attack surface requires compromising an account added as an SIP-7 signer.
179+
180+
### Upgrade and Storage Slots
181+
182+
`ImmutableSignedZoneV2.sol` is not upgradeable, and hence not subject to an upgrade attack.
183+
11184
## Perceived Attackers
12185

186+
This section lists the attackers that could attack the trading system.
187+
188+
It is assumed that all attackers have access to all documentation and source code of all systems related to the Immutable zkEVM, irrespective of whether the information resides in a public or private GitHub repository, email, Slack, Confluence, or any other information system.
189+
190+
### Spear Phisher
191+
192+
This attacker compromises accounts of people by using Spear Phishing attacks. For example they send a malicious PDF file to a user, which the user opens, the PDF file then installs malware on the user's computer. At this point, it is assumed that the Spear Phisher Attacker can detect all key strokes, mouse clicks, see all information retrieved, see any file in the user's file system, and execute any program on the user's computer.
193+
194+
### Server Powner
195+
196+
This attacker is able to compromise any server computer, *Powerfully Owning* the computer. For instance, they can compromise an Immutable server responsible for signing SIP-7 data. They can read values from the computer's RAM and access key material for an SIP-7 signer.
197+
198+
### Immutable zkEVM Block Proposer
199+
200+
An operator of an Immutable zkEVM Block Proposer could, within narrow limits, alter the block timestamp of the block they produce. If this block included transactions related to this zone, it could allow an expired signature to evaluated as valid.
201+
202+
### Insider
203+
204+
This attacker works for a company helping operate the Immutable zkEVM. This attacker could be being bribed or blackmailed. They can access the keys that they as an individual employee have access to. For instance, they might be one of the signers of the multi-signer administrative role.
205+
13206
## Attack Mitigation
14207

208+
This section outlines possible attacks against the attack surfaces by the attackers, and how those attacks are mitigated.
209+
210+
### `DEFAULT_ADMIN` Role Account Compromise
211+
212+
**Detection:** Monitoring role change events.
213+
214+
The mitigation is to assume that the role will be operated by multi-signature addresses such that an attacker would need to compromise multiple signers simultaneously. As such, even if some keys are compromised due to the Spear Phishing Attacker or the Insider Attacker, the administrative actions will not be able to be executed as a threshold number of keys will not be available.
215+
216+
### `ZONE_MANAGER` Role Account Compromise
217+
218+
**Detection:** Monitoring SIP-7 signer events.
219+
220+
The mitigation is to assume that the role will be operated by multi-signature addresses such that an attacker would need to compromise multiple signers simultaneously. As such, even if some keys are compromised due to the Spear Phishing Attacker or the Insider Attacker, the administrative actions will not be able to be executed as a threshold number of keys will not be available.
221+
222+
### SIP-7 Signer Account Compromise
223+
224+
**Detection:** Monitoring order fulfilment events against SIP-7 data signed by Immutable's systems.
225+
226+
The Spear Phisher or Server Powner Attackers can compromise Immutable's systems to extract SIP-7 signer key material. Due to the nature of the trading system requiring high frequency signing of SIP-7 data, signer key material is stored on the server. The mitigation to this is to rotate SIP-7 signers on a regular cadence.
227+
228+
### `block.timestamp` Manipulation
229+
230+
This attack performed by an operator of an Immutable zkEVM Block Proposer, could allow an attacker to alter the result of order validation, only where it concerns SIP-7 signature expiry within a narrow time range. This attack is unlikely to be meaningful for an attacker.
231+
15232
## Conclusion
233+
234+
This threat model has presented the architecture of the system, determined attack surfaces, and identified possible attackers and their capabilities. It has walked through each attack surface and based on the attackers, determined how the attacks are mitigated.

0 commit comments

Comments
 (0)