Audit Open Original ↗
Scroll zstd Compression
Type
Security review
Client
Scroll
Date
2024-06
Domain
Blockchain
Effort
12 wks
Section
Scroll
Trail of Bits's security review of Scroll (Jun 2024) identified 13 issues: 2 high, 3 low, 6 informational, and 2 undetermined.
Findings · 13
- 1 Multiple missing Boolean constraints on Boolean advice columns High
- 2 Column annotations do not match lookup table columns Informational
- 3 Unexpected BlockType for LiteralsHeader reaches unreachable! macro Informational
- 4 RomTagTransition table does not allow ZstdBlockSequenceHeader -> BlockHeader transitions Undetermined
- 5 The back referencing phase is not properly constrained to a monotone behavior once activated Undetermined
- 6 The blob-based public input commitment scheme is poorly documented Informational
- 7 Left shift leads to undefined behavior Low
- 8 Missing constraints for Block_Maximum_Size Low
- 9 Apparent discrepancy between bitwise-op-table configuration and code comment Informational
- 10 The compression mode reserved field is not enforced to equal zero Low
- 11 The tag_config.is_change witness is partially unconstrained Informational
- 12 The is_llt/is_mot/is_mlt constraints are only valid if self.table_kind is in {1, 2, 3} High
- 13 Values larger than 23 satisfy the "spans_three_bytes" constraints Informational
Findings extracted from the published report PDF. See the full report below for details and remediation.
Related