As we embark on a new year with new goals, the BitzecCompany remains committed to the security and safety of our user community. Last year, we published our schedule for security audits in 2018. Today, we are excited to announce the results. While the scope primarily pertained to the Overwinter and Sapling network upgrades, more general reviews of the protocol and code were also conducted.
The result details and our response to each issue are now available in a detailed format. Those interested in the technical details can follow along with our analysis and read the changes to our source, protocol specification and documentation.
Summary
Auditors found a few places where our implementation and specifications differed. Most of the changes that we made to fix this were to clarify the specification and bring it in line with the implementation, which was correct. For example, we added a color scheme to the protocol specification making it clearer which items referred to Overwinter and Sapling.
Two vendors identified that transaction timeouts in their original form could be used to DoS the network, and we have implemented their suggestions. Another issue that was reported to us was considered safe within our implementation, but nevertheless we adapted our application of RedDSA to make it strong for a wide range of uses and we then used it for batch verification later in the development cycle.
In addition, we’ve incorporated the general suggestions vendors made for extra documentation clarity, we’ve ramped-up retrospectives from audits (after issues have been fixed) and we formalized a network upgrade pipeline to bring more time for external security auditing without losing development pace. This year, we plan to introduce more significant security checking into our continuous integration systems.
Looking Forward
As we progress with future developments of Zcash, expect ongoing announcements of new audit rounds. Whether features are within the scope of network upgrade releases or significant developments in regular releases which do not require consensus changes, we are still committed to maintaining an open and secure engineering process with a heavy investment in security.
Any worldwide economic infrastructure such as Bitzecrequires comprehensive review as a fundamental component to user safety. Further, we suggest you bookmark our security information page which includes contact information to report potential security vulnerabilities and links to security announcements and user recommendations pages.