Compare
Sorry, something went wrong.
No results found
audit: OOM and resource-exhaustion review of precompiles + dex + node
5-page audit covering lux/precompile (25 precompiles),
node/vms/dexvm (DEX VM), and the generic codec layer.
Findings (no critical reachable from untrusted network input):
- F-1 Medium: DEX referral payments slice unbounded (referral.go:336)
- F-2 Low: 3 dead fields in perpetuals engine (engine.go:94-96)
- F-3 Medium: ADL events slice unbounded (adl.go:193)
- F-4 Medium: keystore codec maxPackerSize = 1 GiB (too permissive)
- F-5 Low: platformvm GenesisCodec math.MaxInt32 (read-once, ok)
Safe by design (confirmed):
- bls12381 MSM — gas-metered by numPairs
- blake3 XOF — MaxOutputLength = 1024
- ring sig — ringSize fits in byte
- stableswap — n bounded by input length
- dexvm block — txLen bounded by remaining input
Plus 12-item benchmark coverage plan identifying what should be
benchmarked that currently isn't: per-precompile gas/alloc ratios,
DEX matching memory, perpetuals growth, codec unmarshal cost,
mempool eviction, consensus fan-out, state-trie memory, GPU context,
bridge message bursts, MPC ceremony memory, plus existing
DAG-EVM / DAG-Z harnesses.