Attackathon | Movement Labs
Movement Labs is a core contributor to Movement Network, a Move-based blockchain network that settles to Ethereum and creates safer execution environments by way of move.
Evaluating
Triaged by Immunefi
Step-by-step PoC Required
KYC required
Are there any unusual points about your protocol that may confuse Security Researchers?
The nodes are not currently rolling back on settlement failures: https://github.com/movementlabsxyz/movement/blob/main/protocol-units/settlement/mcr/README.md. Settlement logic is out of scope.
Where might Security Researchers confuse out-of-scope code to be in-scope?
- The entire layerzero-devtools repo is not generally in scope. Only the files we modified for our bridge are in scope.
- The indexer / graphql are not in scope.
- Other than the indexer, native_bridge.move, and atomic_bridge.move, the entire aptos-core repo is in scope. However, only certain parts of the movement repo are in scope.
- The nodes are not currently rolling back on settlement failures: https://github.com/movementlabsxyz/movement/blob/main/protocol-units/settlement/mcr/README.md. Settlement logic and MCR is out of scope.
Is this an upgrade of an existing system? If so, which? And what are the main differences?
The Move Language is forked from Aptos-Core, with additional modifications. Any bugs found outside of changes made by Movement Labs in Aptos-Core should be reported to Aptos Labs. Please view the following diff to view the scope of the Attackathon https://github.com/aptos-labs/aptos-core/compare/main...movementlabsxyz:aptos-core:movement.
Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?
We don’t suspect a particular area more strongly than others; all in-scope assets are subject to investigation.
What emergency actions may you want to use as a reason to downgrade an otherwise valid bug report?
Movement has the ability to rollback chain state. Any impacts which do not cause significant damage and can be mitigated by a rollback may be downgraded. Snapshots of state are taken periodically.
Which chains and/or networks is and will the code in scope be deployed to?
The Movement Network.
What external dependencies are there?
- Crates in Cargo.toml
- Base images in the in scope Docker Compose files
Are there any unusual points about your protocol that may confuse Security Researchers?
The nodes are not currently rolling back on settlement failures: https://github.com/movementlabsxyz/movement/blob/main/protocol-units/settlement/mcr/README.md. Settlement logic and MCR is out of scope.
What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc)
https://docs.movementnetwork.xyz
Out-of-scope clauses
The nodes are not currently rolling back on settlement failures: https://github.com/movementlabsxyz/movement/blob/main/protocol-units/settlement/mcr/README.md. Settlement logic is out of scope.
Additionally, the native_bridge.move and atomic_bridge.move files within the aptos-core repository are not in scope as they are not used in production. Please see MOVEOFTAdapter.sol in the layerzero_devtools repository for bridging logic.
Indexer / graphql and MCR / settlement are all considered to be out-of-scope.
The following is always considered out of scope as a security researcher needs to find an applicable in scope impact, which would not be possible if it was the following:
- test and dev logic not directly related to our deployments
- code that is not used