We have been porting, testing and improving the tools of the Avalanche blockchain and some of the libraries that they depend on, and we already have results:
- We helped to improve the security of one library that is central for the Avalance protocol. The Avalanche protocol depends on the BLS12-381 cryptographic signature, in the source code it is implemented by the library supranational/blst. Using our methodology we reported a crash of this library in OpenBSD/adJ due to a security feature of that OS (see issue 206). With our feedback the author of blst solved the problem and improved the security of the library with the commits dae1f and 6cca1 --a constant table goes to a read-only section (.rodata) not allowing an attacker to modify it after the program starts.
- We contributed 4 pull requests with small improvements in portability. They were already merged in the main avalanche tools
- We contributed one pull request that adds support for OpenBSD to avalanchego. This one is waiting approval and hopefully merging.
With the funding of this project we will go through a deeper audit of the sources, completing the porting effort and more integral testing to keep contributing pull requests and suggestions to improve the security of Avalanche tools and the libraries that they depend on.