Wallet + Codec - Spacemesh

1. Introduction

Spacemesh engaged Halborn to conduct a security assessment on their wallet web application, beginning on July 11th 2024 and ending on July 25th 2024. The security assessment was scoped to the Spacemesh wallet web application.

The Spacemesh team provided the source code to Halborn in order to conduct the security assessment. Halborn's team was using different tools to scan, detect and validate possible vulnerabilities found in the wallet (statically and dynamically), reporting the findings at the end of the engagement. The client provided a source code of the wallet, which it was used during the assessment.

2. Assessment Summary

The team at Halborn was provided two weeks for the engagement and assigned a full-time security engineer to verify the security of the Spacemesh wallet web application. The security engineer is a penetration testing expert with advanced knowledge in web, recon, discovery & infrastructure penetration testing and blockchain and smart-contracts security.

The purpose of this assessment is to:

• Improve the security of the application by testing it both as white and black-box approaches

• Identify potential security issues that could be affecting the web application

In summary, Halborn did not identify any critical issues but found some security risks, including four HIGH and five MEDIUM issues.

It was possible to leak the mnemonic phrase from the memory dump, as well as the users' password and private key under different scenarios. In addition, it was possible to bruteforce users passwords with the wallet information stored on disk.

Several huge amount transactions were submitted without having enough balance in the testing wallet, posing a security risk for the wallet and directly impacting on the integrity and consistency of the web application. Many other lacks of user input validation were detected as well.

Moreover, it was detected that Spacemesh wallet was using plaintext connections over HTTP. Other than that, the wallet web application was vulnerable to clickjacking attacks.

It was possible to wipe wallet data through browser "localStorage". Finally, some vulnerable dependencies were being used by the Spacemesh wallet.

3. Test Approach and Methodology

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy regarding the scope of the penetration test. While manual testing is recommended to uncover flaws in logic, process and implementation; automated testing techniques assist enhance coverage of the solution and can quickly identify flaws in it.

Several phases and associated tools were used throughout the term of the assessment, including but not limited to:

• Mapping Application Content and Functionality

• Private keys, mnemonic phrase, seed, and assets securely saved

• Exposure of any critical information during user interactions with the blockchain and external libraries

• Attacks that could impact funds, such as draining or manipulating of funds

• Application logic flaws

• Lack of validation on input forms and Input handling

• Application cryptography

• Brute force protections

• Fuzzing

• Test for Injection (SQL/JSON/HTML/JS/Command/Directories...)

• Vulnerable or outdated dependencies.

• Authentication / Authorization flaws

• Testing for different types of sensitive information leakages: memory, clipboard, ...

• Perform static analysis on code

• Identify other potential vulnerabilities that may pose a risk to Spacemesh