Smart Contract Assessment alkanes-rs

Introduction#

Subfrost engaged Halborn to assess the Alkanes protocol, guest runtime, Rune and Protorune indexing logic, genesis contract behavior, and the MetaShrew components included in the agreed source scope. The assessment focused on externally exploitable defects, asset-accounting failures, state-consistency errors, denial of service, unsafe host and guest boundaries, and economic abuse.

Original Assessed Source Revisions#

The authoritative assessment baselines are alkanes-rs v2.2.1-rc.4 at 40d3fec4746ba1940d5d77d20ab073de4524fb6b and metashrew v9.0.5-rc.15 at 3404d506ccc7517f733a566a9b9ad76d98bcbcb4. Findings identify mixed-scope or adjacent components explicitly. Older version text in administrative scoping metadata is historical sales-intake information and is not the assessed source baseline.

Remediation Revision#

Subfrost identified alkanes-rs v3.0.0-rc.3 as the release containing the client's remediations. The published release tag in kungfuflex/alkanes-rs resolves to commit c12fe072eace239edea950df6b4b5fdf596c6a45.

This reference identifies the remediation target. Full regression verification against this release remains incomplete, and remediation outcomes must be documented per finding against the tested revision and build. The findings and test results below apply to the original assessed revisions unless an individual finding explicitly records a later verified revision. This report does not establish a full audit of all changes introduced in v3.0.0 or equivalence with a deployed production artifact.

Assessment Summary#

Halborn identified 24 current findings: 16 Medium, 5 Low, and 3 Informational. No findings are currently classified as High or Critical. Every current finding has a linked, passing PoC or focused security test. The final reconciliation also reviewed all 42 pending provisional scanner findings. Three were duplicates of two existing findings and 39 did not meet the reporting threshold after source, reachability, rollback, configuration, and impact validation. None added a new current vulnerability.

A mixed-scope wallet carrier issue is rated Medium 6.3. Testing confirmed that a selected contract can receive an unrequested carried asset. The score reflects the demonstrated direct asset impact.

The principal in-scope findings concern economic accounting and state consistency. Confirmed behaviors include whole-transaction rollback that can strand assets after Bitcoin inputs are spent, input aggregation overflow, permanent loss when protocol assets are spent without a matching Protostone, rejected mints consuming allowance without issuance, a zero relative mint end being interpreted as unbounded, Cenotaph mints preserving allowance, and a final DIESEL mint crossing the configured supply cap. The client confirmed that assets burned by transfers without a matching Protostone are not currently recoverable.

The assessment also confirmed release and availability issues. The selected mainnet build embeds a regtest genesis artifact whose behavior differs from a clean mainnet rebuild at the DIESEL cap boundary. Public deployment of a contract with a declared memory maximum below 512 pages reaches a host panic path. A current-sequence factory call can persist a recursive self-alias. Contract decompression has no decoded-size limit before host allocation, and the current release does not contain the protection described for the v10 development branch. Shared gateway workers and view permits can also be exhausted through the reported unauthenticated paths.

Historical findings fixed in the selected current baselines are excluded from the current finding count. Their two remaining historical PoC rows are retained only for traceability and are marked Not Applicable. This includes the older balance-reconciliation duplication behavior and the MetaShrew out-of-order gap behavior corrected in rc.15.

Test Approach and Methodology#

The assessment combined file-by-file manual review, architecture and trust-boundary analysis, source-to-sink tracing, attacker and developer perspectives, economic-invariant analysis, historical comparison, mainnet-aware configuration review, and focused dynamic validation. Candidate findings were tested against caller behavior, transaction rollback boundaries, network configuration, production reachability, and alternative explanations before promotion.

The frozen inventory contains 136 reviewed files: 94 explicit engagement-scope targets and 42 required context, test, build, and integration files. All 136 matched their pinned hashes and received both a complete review record and a backward reread. The static ledger contains 548 distinct checks and 95 structured candidates. This establishes complete file-level coverage for the frozen inventory, but it does not guarantee the absence of every possible defect.

The current Nexus test plan contains 228 rows. After reconciliation, 24 current finding PoCs are Pass, two historical PoCs are Not Applicable, and 202 source-test review rows remain Pending because their test bodies were reviewed but were not executed in a verified target build. Those Pending rows state this limitation explicitly and must not be represented as runtime passes or failures.

Dynamic validation covered native and WebAssembly paths where supported, optimized builds, exact-host or current-equivalent harnesses, clean adjacent controls, replay and rollback behavior, Rune and Protorune lifecycle transitions, mainnet feature behavior, and gateway isolation. The client PoC package contains 24 current finding directories and 156 hashed artifacts. Its integrity verifier reported no missing, duplicate, size-mismatched, or hash-mismatched artifacts.

Mainnet evidence was used read-only. No destructive public-chain action was performed. Local gateway demonstrations used isolated localhost processes and fake backends. These tests prove the reported code behavior but do not independently prove public deployment reachability, production credentials, deployed artifact identity, or realized financial loss unless a finding states otherwise.

Adjacent Future Upgrade Review#

At the client's request, Halborn also reviewed Diesel v3 PR #306 separately from the frozen release. Two economic behaviors were confirmed: same-block changes to max_mints_per_block can make reward accounting inconsistent across mints in that block, and syntactically counted mint messages that later fail can suppress valid-minter emission. Their provisional BVSS scores are 5.1 Medium and 5.0 Medium. They are not included in the 24 current findings because PR #306 is a future upgrade outside the frozen baseline. They should be carried into a dedicated review of the final Diesel v3 revision, gate contract, and committed-to-deployed WASM artifact.

Recommended Next Steps#

1. Prioritize asset-accounting and irreversible-loss findings. Make allowance changes, balance movement, refunds, and output persistence part of one atomic state transition. Add regression tests for rejected messages, overflow boundaries, replay, restart, and reorganization behavior.

2. Enforce resource limits before allocation or execution. Add a decoded-size limit to gzip processing, bound multicalls and view work, isolate worker pools, and convert attacker-controlled panic paths into explicit errors.

3. Bind releases to reviewed artifacts. Reproduce the mainnet genesis WASM with the release toolchain, compare its behavior and hashes with the embedded artifact, and record the exact artifact deployed at each activation height.

4. Complete the Diesel v3 review before activation. Confirm block-emission invariants, define the effect of failed counted mints and same-block parameter changes, review the production gate contract, and rerun the focused economic suite against the final integrated commit and deployment artifact.

5. Retest remediation against the same attacker PoCs. A source change or passing broad suite should not close a finding until the original exploit test fails safely, the adjacent valid control still passes, and the final integrated release artifact matches the tested build.

The report should be revisited when gateway deployment evidence, final Diesel v3 assessment evidence, and verification results for the remediation release become available. Conditional deployment facts are stated as conditions rather than assumed. The current conclusions are bounded to the source revisions, configurations, tests, and proof limits documented in each finding.

Risk Methodology#

Scope#