Author: ArweaveB

Translation: Haocheng Xu

Reviewer: Kyle

Source: Content Guild - Translation

The ArConnect project announced that it has completed an audit of its source code and successfully fixed the issues that were exposed.

ArConnect, the leading wallet in the Arweave ecosystem, was the first wallet to undergo a security audit in August 2023. It said the second audit was conducted in April 2024 over a 12-day period, with security being the top priority.

Community Labs CEO Tate Berenbaum called the report "solid" and said it was "far more important than any usage metric."

The results of the latest audit were conducted by Spearbit and Open Security and published in the Open Security Risk Assessment. The purpose of the audit was to identify potential methods of attack against the ArConnect browser extension that could be exploited by any external party.

The report states that the audit used a methodology developed by the Open Web Application Security Project (OWASP). The entire audit was conducted on the Google Chrome browser with the development version of the ArConnect browser extension installed.

The auditors developed a custom malicious proof-of-concept for testing suspected vulnerabilities. They also modified and tested a development version of the Connect browser extension with maliciously modified source code, hosted a web server with a malicious payload, and debugged the browser extension.

The security audit found zero critical risks, one high risk, and five informational vulnerabilities. However, the report states that all issues found have been fixed to only informational severity.

In describing the open source dependency vulnerabilities rated as high risk in the audit, auditors noted that the security of dependencies is also part of the software supply chain and is a major attack surface. The report states that the supply chain can impact the security of a product at any time during the development process, either through malware that attacks the developer tools themselves or by simply introducing vulnerabilities into the software.

“ArConnect’s primary risk stems from vulnerabilities in open source dependencies,” the auditors noted, adding that “Community Labs must continuously update and apply upstream patches to open source dependencies to prevent supply chain attacks.”

Auditors also recommended code changes to strengthen the Connect browser extension.

🏆 "Catch Bugs" to Get Rewards: If you find typos, incorrect sentences, or incorrect descriptions in this article, click here to report them and you will get rewards.

🔗 About PermaDAO: Official Website | Portal | Twitter | Telegram | Discord | Medium | Youtube