Skip to main content
Version: v0.15.0

Overview

This page serves as an overview of the Obol Network from a security auditor’s point of view. It lists all of the projects that are intended to fall under the scope of the Obol Network project, as well as past audit reports, notable security bugs, and open security/privacy challenges in the Obol Network. You can think of this page as “a security auditor’s guide to Obol.”

This page is updated quarterly. The last update was on 2023-03-21.

Table of Contents​

  1. Open Challenges
  2. Core Public Goods
  3. List of Security Audits

Open Challenges​

These are the “big picture” security challenges for Obol Network that are on our radar.

Validation of Contract Deployment and Deposit Data Relies Heavily on Launchpad​

The risks identified include the possibility of malicious contracts being deployed by attackers who compromise the Launchpad or an underlying dependency.

Key concerns raised by the auditor:

  1. How does the group creator know the Launchpad deployed the correct contracts?
  2. How does the rest of the group know the creator deployed the contracts through the Launchpad? The current verification process relies on the independent verification performed by each group member during and after the cluster's setup phase. However, this process may not be sufficient, as most users lack the necessary expertise to verify the source code accurately.

The primary risk is that users may deposit with malicious withdrawal or fee recipient credentials, potentially allowing an attacker to steal the entire withdrawal amount once the cluster exits.

The audit also mentions similar risks in validating deposit data but lacks clarity on the Obol stack's specific part that generates the deposit data/transaction.

The auditor suggests that the mitigation for these risks would involve a more thorough and reliable verification process, although further details are not provided in the summary.

Social Consensus, aka “Who sends the 32 ETH?”​

Obol allows multiple operators to act as a single validator, requiring a total of 32 ETH for depositing to the beacon chain. Currently, the process relies on trust and social consensus, where the group decides on individual contributions and trusts someone to complete the deposit process correctly without misusing the funds.

While the initial launch of Obol is limited to a small group, for a future public release, the deposit process should be simpler and less reliant on trust to ensure security and user confidence.

Core Public Goods​

The Obol Network consists of four core public goods:

  • The Distributed Validator Launchpad, a User Interface for bootstrapping Distributed Validators
  • Charon, a middleware client that enables validators to run in a fault-tolerant, distributed manner
  • Obol Managers, a set of solidity smart contracts for the formation of Distributed Validators
  • [Obol Testnets])(https://docs.obol.tech/docs/testnet), a set of on-going public incentivized testnets that enable any sized operator to test their deployment before serving for the mainnet Obol Network

List of Security Audits​

2023​

The completed audits reports are linked here.