In this report, we present the results of the audit of the Lachain protocol consensus made upon their request. The Lachain team chose for their network Honey Badger Byzantine Fault Tolerance consensus. BFT consensuses are green (sustainable) consensuses: energy consumption of BFT consensuses is significantly lower than Proof of Work ones because they do not entail a computation puzzle. HoneyBadger consensus is one of the modern implementations of BFT consensuses with their definitive feature, compared to the rest of the BFT consensuses, being asynchronous, i.e. independent from the network timing assumptions. Synchronous and weakly synchronous of consensuses mean that a consensus can be reached only if the network performs as expected. The HB BFT consensus can work independently from the network timing parameters and therefore may work on a larger range of networks (e.g. TOR network with big latencies). The development of the network and consensus by the Lachain team took 2 years. At this time, the 2 most popular realizations of the HB BFT consensus are Andrew Miller’s version written in python and POA network’s version in Rust. As far as we know, the current version is the first one written in one of the most popular coding languages C#.

 We’ve investigated the consensus algorithm and focused mainly on the consensus sabotage possibilities. Since the Lachain team advertises their consensus as an HBBFT realization, we’ve referenced A. Miller’s paper [2], considering also the already discovered issues in HBBFT repo and other model and production implementations [7]. 

As a result of our inspection, we've introduced several concerns that may threaten consensus result convergence and a separate node service availability. By substituting a share with an invalid one during the decryption phase a perpetrator could freeze new blocks on adding to the blockchain, halting all transitions for an indefinite period of time until a byzantine node is detected and removed. Also, the lack of external message validation made nodes potentially vulnerable to DoS attack by malicious nodes since addressing to existing module led to its instant initialization.

In the provided update, the Lachain team acknowledged the issues and added fixes for 'Decrypted share validation' and Possible DoS by a byzantine validator' problems. Although the implementation of the coin algorithm preserves a slight discrepancy to the original paper, we have doubts regarding the adverse effects of the modification, as the consensus performance and properties are not compromised. All things considered, we ensure compliance of the audited consensus implementation with the specifications of the HBBFT whitepaper.

Lachain.Consensus

This is a limited report on our findings based on our analysis, in accordance with good industry practice at the date of this report, in relation to cybersecurity vulnerabilities and issues in the code, the details of which are set out in this report. In order to get a full view of our analysis, it is crucial for you to read the full report. While we have done our best in conducting our analysis and producing this report, it is important to note that you should not rely on this report and cannot claim against us on the basis of what it says or doesn’t say, or how we produced it, and it is important for you to conduct your own independent investigations before making any decisions. We go into more detail on this in the disclaimer below – please make sure to read it in full.

By reading this report or any part of it, you agree to the terms of this disclaimer. If you do not agree to the terms, then please immediately cease reading this report, and delete and destroy any and all copies of this report downloaded and/or printed by you. This report is provided for information purposes only and on a non-reliance basis and does not constitute investment advice. No one shall have any right to rely on the report or its contents, and HashEx and its affiliates (including holding companies, shareholders, subsidiaries, employees, directors, officers, and other representatives) (HashEx) owe no duty of care towards you or any other person, nor does HashEx make any warranty or representation to any person on the accuracy or completeness of the report. The report is provided "as is", without any conditions, warranties, or other terms of any kind except as set out in this disclaimer, and HashEx hereby excludes all representations, warranties, conditions, and other terms (including, without limitation, the warranties implied by law of satisfactory quality, fitness for purpose and the use of reasonable care and skill) which, but for this clause, might have effect in relation to the report. Except and only to the extent that it is prohibited by law, HashEx hereby excludes all liability and responsibility, and neither you nor any other person shall have any claim against HashEx, for any amount or kind of loss or damage that may result to you or any other person (including without limitation, any direct, indirect, special, punitive, consequential or pure economic loss or damages, or any loss of income, profits, goodwill, data, contracts, use of money, or business interruption, and whether in delict, tort (including without limitation negligence), contract, breach of statutory duty, misrepresentation (whether innocent or negligent) or otherwise under any claim of any nature whatsoever in any jurisdiction) in any way arising from or connected with this report and the use, inability to use or the results of the use of this report, and any reliance on this report. The analysis of the security is purely based on the code alone. No applications or operations were reviewed for security. No product code has been reviewed. HashEx owns all copyright rights to the text, images, photographs, and other content provided in the following document. When using or sharing partly or in full, third parties must provide a direct link to the original document mentioning the author (<a href="https://hashex.org/">hashex.org</a>).

Lachain consensus

Project Summary

Audit

Issues

Conclusion

Disclaimer

Our most popular audits

HashEx works with the most well-known blockchain brands

Let's Work Together! Write now.