Code Audits
At Bluefin, our primary goal is to build an incredibly performant, user-friendly decentralized exchange (DEX) that meets the highest security and transparency standards. We invest significant development effort into designing secure code and architecture and frequently review it to ensure quality. We routinely test and re-evaluate our products for code and business logic vulnerabilities.
To further strengthen our security measures, we partnered with PeckShield, Trail of Bits, and ChainTroopers for audits of Bluefin's smart contracts and with Halborn for full-stack penetration testing. We have also prepared a Bug Bounty Program for maximum community input and transparency.
PeckShield - Audit Results
PeckShield audited Bluefin's V1 repository, which includes Governance, Insurance Fund, Token Vesting, and Timelock smart contracts. The audit discovered:
0 Critical issues
0 High issues
0 Medium issues
3 Low issues
1 Informational issue
Two of the low-severity issues have been resolved, and one is acknowledged. The acknowledged issue—regarding proposal execution cost—is impossible to reproduce in our contracts and app since no function calls require native tokens. In the low likelihood scenario where the Governance approves a proposal implementing such a function in the future, the proposal will also have to include the necessary changes to the Governance::execute() method to ensure the call is not reverted.
Trail of Bits - Order Matching, Orderbook and Settlement Engine Audit Results
Trail of Bits audited Bluefin’s order matching engine and orderbook, staking, and liquidity provider contracts. The audit discovered:
0 Critical issues
2 High issues
3 Medium issues
0 Low issues
8 Informational issues
One of the High issues has been completely fixed with the use of KMS and now sensitive information is no longer passed through the command line.
The other High issue mentions the possibility of crashing the order matching service by sending an extremely excessive amount of trades and hence running out of memory. Since the assessment, Bluefin has implemented rate-limiting through Cloudflare to mitigate against a malicious actor opening millions of trades to crash the order-matching service. Also, the matching engine service will soon be migrated to Kubernetes to be able to scale on demand and handle an even larger number of open orders.
Halborn - Penetration Test Results
Halborn, an elite cybersecurity company for blockchain organizations, has completed its White Box Penetration Test of the Insurance Fund and Governance applications. The test discovered:
0 Critical issues
0 High issues
3 Medium issues
3 Low issues
2 Informational issues
All issues outlined in the White Box testing report have been resolved.
Upgradeable Contracts and Governance
We have made our contracts upgradeable and built Governance contracts for our community to vote on upgrades or adjust parameters as needed. We believe in the Web3 vision of permissionless protocols accessible to all and guided by the community.
Guardrail - Web3.0 Monitoring
Apart from prevention-focused audits, Bluefin recognizes that this paradigm is insufficient and that several levels of cyber security are required to keep our clients secure.
Bluefin took the 'assumed compromise' approach to prepare for the severity and frequency of today's Web3.0 hacks. 'Assume compromise' is a security attitude change that accepts existing security measures' shortcomings in the face of new cyber threats. The method is based on the premise that an adversary will be able to get access to a network environment.
In this matter, we have partnered up with Guardrail, which provides us with advanced detection capabilities such as:
An end-to-end, continuous platform to monitor, detect, and prevent attacks across our Web3.0 stack
24x7x365 Threat Detection
Robust alerting with real-time notifications and monitoring of on-chain events, unusual or unexpected events, and potential security issues. For example:
Calls to
onlyAdminfunctionsInteractions with Tornado-cash users
Large USDC transactions
Anomalous Gas Usage
Last updated